A method and network device for configuring ACL rules and matching messages

Abstract

The present specification provides a method and network device for configuring ACL rules and matching messages, the method comprising: obtaining a target ACL rule to be issued, and obtaining the value of a target port number corresponding to the target ACL rule, determining whether the value of the target port number is an exact value or a range value, and if it is a range value, obtaining the corresponding range code through a range database and constructing a TCAM table entry, or, if it is an exact value, constructing a TCAM table entry according to the exact value. Through this method, ACL rules for one or more port ranges can be implemented, occupying only one TCAM table entry space, greatly saving TCAM storage resources.

Description

Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to a method and network device for configuring ACL rules and matching messages. Background Art

[0002] At the core nodes of the communication network, there are extremely high requirements for message forwarding performance. It is difficult to achieve forwarding performance of hundreds of G or even T levels using only software forwarding models.

[0003] As a hardware acceleration engine for ACL lookup, TCAM (ternary content addressable memory) chips have basically become a must-have for high-end routing and switching equipment.

[0004] like Figure 1 As shown in the figure, a typical packet forwarding architecture based on TCAM chip is provided: the CPU runs software to form the control plane, and the packet processing engine and TCAM engine together form the data plane. The control plane sends forwarding-related entries to the packet processing engine and sends ACLs to the TCAM engine. When a packet enters the device, it is processed by the packet processing engine. If it involves ACL query, the key found is passed to the TCAM engine, and the packet is processed according to the result returned by the TCAM engine, and then forwarded. Summary of the invention

[0005] The embodiments of the present disclosure provide a method and a network device for configuring ACL rules and matching messages. Through this method, ACL rules for one or more port ranges can be implemented, occupying only one TCAM table entry space, thereby greatly saving TCAM storage resources.

[0006] The present disclosure provides a method for configuring ACL rules, the method comprising:

[0007] Obtain the target ACL rule to be issued, and obtain the value of the target port number corresponding to the target ACL rule;

[0008] Determine whether the value of the target port number is an exact value or a range value;

[0009] If it is a range value, the corresponding range code is obtained through the range database and a TCAM table entry is constructed;

[0010] Alternatively, if it is an exact value, a TCAM table entry is constructed according to the exact value.

[0011] The method also includes constructing a range database, wherein the range database includes: a correspondence between port number segments and range codes.

[0012] Wherein, when the value of the target port number is a range value, a target range code corresponding to the range value of the target port number is obtained according to the range database;

[0013] The target range code is converted to obtain a first code value, the first code value is used as the port domain range value of the TCAM table entry, and the mask is used as the port domain precise value of the TCAM table entry.

[0014] Among them, when the value of the target port number is an exact value, the exact value is encoded and converted to obtain a second encoded value, the second encoded value is used as the port domain exact value of the TCAM table entry, and the mask is used as the port domain range value of the TCAM table entry.

[0015] The target port number includes: the original port number or the destination port number.

[0016] It can be seen from the above embodiments that when TCAM table entries are issued according to the ACL rules to be issued, the ACL rules can be issued to the TCAM table entries according to the value of the target port number corresponding to the ACL rules, and the ACL rules of ports in the same range segment can be issued to the same TCAM table entry, which greatly saves TCAM storage resources.

[0017] The embodiment of the present disclosure also provides a method for matching messages based on TCAM, the method comprising:

[0018] Receive a first message and obtain a first port number of the first message;

[0019] querying a range database according to the first port number to obtain a corresponding first range code, performing code conversion on the first range code to obtain a third code value, and performing code conversion on the first port number to obtain a fourth code value;

[0020] Using the third coding value and / or the fourth coding value to match a TCAM table entry to obtain a matched ACL rule;

[0021] The TCAM table entry includes: a port domain range value and a port domain precise value, wherein the port domain range value is determined according to the port range value corresponding to the ACL rule, and the port domain precise value is determined according to the port precise value corresponding to the ACL rule.

[0022] The embodiment of the present disclosure further provides a network device, the network device supports TCAM-based ACL matching, and the network device includes:

[0023] An acquisition module is used to acquire a target ACL rule to be issued, and acquire a value of a target port number corresponding to the target ACL rule;

[0024] A judgment module, used to determine whether the value of the target port number is an exact value or a range value;

[0025] A processing module, configured to obtain a corresponding range code from a range database and construct a TCAM table entry if the judgment module determines that the value is a range value;

[0026] Alternatively, if it is an exact value, a TCAM table entry is constructed according to the exact value.

[0027] Wherein, the processing module is also used to construct a range database, and the range database includes: a correspondence between port number segments and range codes.

[0028] Among them, the processing module is specifically used to obtain the range value of the target port number if the judgment module determines that it is a range value, obtain the target range code corresponding to the range value of the target port number according to the range database, convert the target range code to obtain a first code value, use the first code value as the port domain range value of the TCAM table entry, and use the mask as the port domain precise value of the TCAM table entry.

[0029] Among them, the processing module is specifically used to encode the precise value to obtain a second encoded value if the judgment module determines that it is an exact value, and use the second encoded value as the port domain precise value of the TCAM table entry and the mask as the port domain range value of the TCAM table entry.

[0030] The present disclosure also provides a network device, the network device comprising:

[0031] An acquisition module, used for receiving a first message and acquiring a first port number of the first message;

[0032] A query module, configured to query a range database according to the first port number, obtain a corresponding first range code, perform code conversion on the first range code to obtain a third code value, and perform code conversion on the first port number to obtain a fourth code value;

[0033] A processing module, configured to match the third coding value and / or the fourth coding value with a TCAM table entry to obtain a matched ACL rule;

[0034] The TCAM table entry includes: a port domain range value and a port domain precise value, wherein the port domain range value is determined according to the port range value corresponding to the ACL rule, and the port domain precise value is determined according to the port precise value corresponding to the ACL rule. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the specification and, together with the description, serve to explain the principles of the specification.

[0036] Figure 1 A schematic diagram of a message forwarding architecture based on a TCAM chip provided in an embodiment of the present disclosure.

[0037] Figure 2 A logical diagram of a method for configuring ACL rules provided in an embodiment of the present disclosure.

[0038] Figure 3 A schematic diagram of an architecture for adding an additional range coding domain to an ACL key provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0039] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with this specification. Instead, they are merely examples of devices and methods consistent with some aspects of this specification as detailed in the appended claims.

[0040] The terms used in this specification are for the purpose of describing specific embodiments only and are not intended to limit this specification. The singular forms "a", "the" and "the" used in this specification and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0041] It should be understood that although the terms first, second, third, etc. may be used in this specification to describe various information, this information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of this specification, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0042] Currently, in the TCAM-based ACL rule matching technology, a range needs to be converted into multiple prefixes. As long as the key matches any prefix, the result is considered to be found.

[0043] For example, if an ACL rule R concerns packets with a TCP destination port number in the range of [100,150], then rule R needs to be expanded into 7 sub-rules, and the destination ports of these 7 sub-rules are converted into the prefixes in Table 1 respectively:

[0044] Subrange Corresponding prefix [100,103] 0110 01** [104,111] 0110 1*** [112,127] 0111 **** [128,143] 1000 **** [144,147] 1001 00** [148,149] 1001 010* [150,150] 1001 0110

[0045] Table 1

[0046] Due to the limited capacity of TCAM chips, the expansion of one ACL rule into multiple prefixes has a great impact on the chip capacity. Taking the port number as an example, in the worst case, a port number range needs to be expanded into 31 prefixes; if the source port and destination port are both ranges, one rule needs to be expanded into 31×31 prefixes, resulting in a sharp reduction in the number of ACL rules with ranges that the TCAM chip can accommodate.

[0047] In order to solve the above technical problems, the present disclosure provides a method for configuring ACL rules, such as Figure 2 As shown, the method includes:

[0048] S201 obtains the target ACL rule to be issued, and obtains the value of the target port number corresponding to the target ACL rule;

[0049] S202 determines whether the value of the target port number is an exact value or a range value;

[0050] If it is a range value, then obtain the corresponding range code from the range database and construct a TCAM table entry.

[0051] S204 Or, if it is an exact value, construct a TCAM table entry according to the exact value.

[0052] Through the method disclosed in the present invention, by using the encoding technology for the range domain in the ACL, the occupation of TCAM storage space by ACL rules with ranges is greatly reduced.

[0053] In this embodiment, the method disclosed herein can be applied to network devices, such as switches, routers, and servers, and can be particularly applied to our company's core routers and core switches.

[0054] The inventors found through analysis of the actually issued ACL model that for M ACL rules, the port number range concerned is N segments, and the value of M is much larger than N. For example, for 100K ACL rules, the port number range concerned is only 1K segments or even less.

[0055] For example, Rule 1 focuses on UDP packets with a destination port number within [100,150], and Rule 2 focuses on TCP packets with a destination port number within [100,150]. It can be seen that the port number ranges corresponding to Rule 1 and Rule 2 are the same.

[0056] For another example, rule 1 focuses on UDP packets with a destination IP of 1.1.1.* and a destination port number of [100,150], and rule 2 focuses on UDP packets with a destination IP of 2.2.2.* and a destination port number of [100,150].

[0057] In the above case, it can be seen that there can be a many-to-one mapping between ACL rules and port number value ranges. Therefore, the present disclosure constructs a separate range database for the same type of range (the present invention does not limit the specific construction method, either an array or an interval tree is acceptable, and for the convenience of description, an array is used as an example).

[0058] In step S201, after obtaining the target ACL rule to be issued, the value of the target port number corresponding to the target ACL rule can be obtained, that is, the value of the target port number concerned by the target ACL is obtained. The target port number can be a source port number or a destination port number.

[0059] Generally, the value of the target port number corresponding to the target ACL may be a range value (such as 100, 150 in the above embodiment) or an exact value, such as port number 128 or 256.

[0060] In step S202, it is determined whether the target port number corresponding to the target ACL is an exact value or a range value.

[0061] When it is a range value, execute step S203.

[0062] In this embodiment, a range database is also constructed in the device, and the range database includes: a correspondence between port number segments and range codes, as shown in Table 2:

[0063] Port Number Section Range Encoding [100,150] 001 [160,200] 002 [210,240] 003

[0064] Table 2

[0065] The port number segment is used to match the range value corresponding to the ACL rule.

[0066] To consider the coexistence of the exact value and range of the port number, an additional range encoding field is added to the ACL key, such as Figure 3 As shown, to take into account the coexistence of range and precise values.

[0067] In step S203, after determining that the value of the target port number is a range value, the corresponding range code is obtained through the range database and code conversion is performed.

[0068] For example, if the destination port number of the ACL rule R1 to be issued is [100, 150], the range code 001 can be obtained by querying Table 2 in the range database, 001 is converted to obtain the first code value 0x0001, and a TCAM table entry is constructed. In this embodiment, the TCAM table entry may include: a port domain exact value and a port domain range value. At this time, 0x0001 is used as the port domain range value, and the mask is used as the port domain exact value. An example of a TCAM table entry is shown in Table 3:

[0069] Port domain range value Port domain exact value 0x0001 ****************

[0070] Table 3

[0071] After determining that the value of the target port number is an exact value, the exact value is converted into a code to obtain a second code value, the second code value is used as the port domain exact value of the TCAM table entry, and the mask is used as the port domain range value of the TCAM table entry.

[0072] For another example, if the destination port number of the ACL rule R2 to be issued is the exact value 128, since it is an exact value, there is no need to query the range database, 128 is encoded and converted to 0x00000080, and a TCAM table entry is constructed. At this time, the port domain range value is the mask, and the port domain exact value is 0x00000080, as shown in Table 4.

[0073] Port domain range value Port domain exact value **** 0x00000080

[0074] Table 4

[0075] For another example, an ACL rule R3 is issued, the destination port number is taken as the precise value 256, the precise value does not need to be checked in the range database, and the TCAM table entry is issued, the destination port domain range is encoded as a mask, and the destination port domain precise value is 0x00000100, as shown in Table 5.

[0076] Port domain range value Port domain exact value **** 0x00000100

[0077] Table 5

[0078] It can be seen from the above embodiments that in this solution, there is no need to expand the ACL rules into several sub-rules and convert the destination ports of the sub-rules into prefixes respectively. Through the solution in the present disclosure, ACL rules for the same port number or port number range can be mapped to the same TCAM table entry, so that one TCAM table entry corresponds to multiple ACL rules, which greatly saves TCAM table entry resources.

[0079] Based on the above embodiments, the present disclosure also provides a method for matching messages based on TCAM, the method comprising:

[0080] Receive a first message and obtain a first port number of the first message;

[0081] querying a range database according to the first port number to obtain a corresponding first range code, performing code conversion on the first range code to obtain a third code value, and performing code conversion on the first port number to obtain a fourth code value;

[0082] Using the third coding value and / or the fourth coding value to match a TCAM table entry to obtain a matched ACL rule;

[0083] The TCAM table entry includes: a port domain range value and a port domain precise value, wherein the port domain range value is determined according to the port range value corresponding to the ACL rule, and the port domain precise value is determined according to the port precise value corresponding to the ACL rule.

[0084] In this embodiment, the first message can be a TCP / UDP message. When the network device receives the first message, it obtains the first port number of the first message according to the preset method (the source port number or the destination port number. For the convenience of description, this embodiment takes the destination port number as an example, and the source port number is the same).

[0085] Normally, the first port number carried in the first message is an exact value. For example, the first port number carried by the first message is 149. The corresponding range code is searched through the range database based on the first port number. For example, it is known from Table 2 that the range code corresponding to 149 is 001. When the message processing engine group key is given to the TCAM engine, the destination port domain range code is assigned to 0x0001, and the exact value is 0x00000095. At this time, according to the above embodiment, it can be known that ACL rule R1 corresponds to the range code 001, and it is determined that the first message corresponds to ACL rule R1.

[0086] In another embodiment, if the first port number carried in the first message is 128, the corresponding range code is searched through the range database according to the first port number. For example, it is known from Table 2 that the range code corresponding to 128 is 001. According to the above embodiment, the port number corresponding to ACL rule R2 is also 128, then it is determined that the rules corresponding to the first message are ACL rule R1 and AC rule R2.

[0087] In another embodiment, if the first port number carried in the first message is 256, it is determined through the range database that there is no corresponding range code in the range database based on the first port number. At the same time, according to the above embodiment, it can be known that the port number 256 corresponds to ACL rule R3. At this time, it can be determined that the rule corresponding to the first message is ACL rule R3.

[0088] The message processing engine completes the processing of the first message according to the result returned by the TCAM engine, and then forwards it.

[0089] It can be seen from the above embodiments that the ACL rules issued through steps S201-S204 can, when actually used, perform rule processing on received messages without extending the prefix, and at the same time, implement the ACL rules of ports in the same range segment being issued to the same TCAM table entry, thereby greatly saving TCAM storage resources.

[0090] Based on the above method embodiments, the embodiment of the present disclosure further provides a network device, the network device supports TCAM-based ACL matching, and the network device includes:

[0091] An acquisition module is used to acquire a target ACL rule to be issued, and acquire a value of a target port number corresponding to the target ACL rule;

[0092] A judgment module, used to determine whether the value of the target port number is an exact value or a range value;

[0093] A processing module, configured to obtain a corresponding range code from a range database and construct a TCAM table entry if the judgment module determines that the value is a range value;

[0094] Alternatively, if it is an exact value, a TCAM table entry is constructed according to the exact value.

[0095] Wherein, the processing module is also used to construct a range database, and the range database includes: a correspondence between port number segments and range codes.

[0096] Among them, the processing module is specifically used to obtain the range value of the target port number if the judgment module determines that it is a range value, obtain the target range code corresponding to the range value of the target port number according to the range database, convert the target range code to obtain a first code value, use the first code value as the port domain range value of the TCAM table entry, and use the mask as the port domain precise value of the TCAM table entry.

[0097] Among them, the processing module is specifically used to encode the precise value to obtain a second encoded value if the judgment module determines that it is an exact value, and use the second encoded value as the port domain precise value of the TCAM table entry and the mask as the port domain range value of the TCAM table entry.

[0098] The present disclosure also provides a network device, the network device comprising:

[0099] An acquisition module, used for receiving a first message and acquiring a first port number of the first message;

[0100] A query module, configured to query a range database according to the first port number, obtain a corresponding first range code, perform code conversion on the first range code to obtain a third code value, and perform code conversion on the first port number to obtain a fourth code value;

[0101] A processing module, configured to match the third coding value and / or the fourth coding value with a TCAM table entry to obtain a matched ACL rule;

[0102] The TCAM table entry includes: a port domain range value and a port domain precise value, wherein the port domain range value is determined according to the port range value corresponding to the ACL rule, and the port domain precise value is determined according to the port precise value corresponding to the ACL rule.

[0103] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0104] Those skilled in the art will readily appreciate other embodiments of the specification after considering the specification and practicing the invention claimed herein. The specification is intended to cover any variations, uses or adaptations of the specification that follow the general principles of the specification and include common knowledge or customary techniques in the art that are not claimed in the specification. The specification and examples are to be considered exemplary only, and the true scope and spirit of the specification are indicated by the following claims.

[0105] It should be understood that the present description is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present description is limited only by the appended claims.

[0106] The above description is only a preferred embodiment of this specification and is not intended to limit this specification. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of this specification should be included in the scope of protection of this specification.

Claims

1. A method for configuring access control list (ACL) rules, characterized in that: The method comprises: Obtain the target ACL rule to be issued, and obtain the value of the target port number corresponding to the target ACL rule; Determine whether the value of the target port number is an exact value or a range value; If it is a range value, the corresponding range code is obtained through the range database and a ternary content addressable memory TCAM table entry is constructed; Alternatively, if it is an accurate value, constructing a TCAM table entry according to the accurate value; If the value is a range value, obtaining a corresponding range code through a range database and constructing a TCAM table entry includes: Obtaining a range value of a target port number, and obtaining a target range code corresponding to the range value of the target port number according to the range database; Performing code conversion on the target range code to obtain a first code value, using the first code value as the port domain range value of the TCAM table entry, and using the mask as the port domain precise value of the TCAM table entry; If the value is a precise value, constructing a TCAM table entry according to the precise value includes: The precise value is converted into a code to obtain a second code value, the second code value is used as the port domain precise value of the TCAM table entry, and the mask is used as the port domain range value of the TCAM table entry.

2. The method according to claim 1, characterized in that The method further comprises: A range database is constructed, wherein the range database includes: a correspondence between port number segments and range codes.

3. The method according to claim 1, characterized in that The target port number includes: an original port number or a destination port number.

4. A method for matching messages based on a ternary content addressable memory TCAM, characterized in that: The method comprises: Receive a first message and obtain a first port number of the first message; querying a range database according to the first port number to obtain a corresponding first range code, performing code conversion on the first range code to obtain a third code value, and performing code conversion on the first port number to obtain a fourth code value; Using the third coding value and / or the fourth coding value to match the TCAM table entry to obtain a matched access control list (ACL) rule; The TCAM table entry includes: a port domain range value and a port domain precise value, wherein the port domain range value is determined according to the port range value corresponding to the ACL rule, and the port domain precise value is determined according to the port precise value corresponding to the ACL rule; Wherein, when the value of the target port number is a range value, a target range code corresponding to the range value of the target port number is obtained according to the range database; the target range code is converted to obtain a first code value, the first code value is used as the port domain range value of the TCAM table entry, and the mask is used as the port domain precise value of the TCAM table entry; When the value of the target port number is an accurate value, the accurate value is converted into a code to obtain a second code value, and the second code value is used as the port field accurate value of the TCAM table entry. The mask is used as the port domain range value of the TCAM table entry.

5. A network device, characterized in that: The network device supports access control list (ACL) matching based on a ternary content addressable memory (TCAM), and the network device includes: An acquisition module is used to acquire a target ACL rule to be issued, and acquire a value of a target port number corresponding to the target ACL rule; A judgment module, used to determine whether the value of the target port number is an exact value or a range value; A processing module, configured to obtain a corresponding range code from a range database and construct a TCAM table entry if the judgment module determines that the value is a range value; Alternatively, if it is an accurate value, constructing a TCAM table entry according to the accurate value; Wherein, the processing module is specifically used to obtain the range value of the target port number if the judgment module determines that it is a range value, obtain the target range code corresponding to the range value of the target port number according to the range database, perform code conversion on the target range code, obtain a first code value, use the first code value as the port domain range value of the TCAM table entry, and use the mask as the port domain precise value of the TCAM table entry; Among them, the processing module is specifically used to encode the precise value to obtain a second encoded value if the judgment module determines that it is an exact value, and use the second encoded value as the port domain precise value of the TCAM table entry and the mask as the port domain range value of the TCAM table entry.

6. The network device according to claim 5, characterized in that: The processing module is further used to construct a range database, which includes: a correspondence between port number segments and range codes.

7. A network device, characterized in that: The network equipment includes: An acquisition module, used for receiving a first message and acquiring a first port number of the first message; A query module, configured to query a range database according to the first port number, obtain a corresponding first range code, perform code conversion on the first range code to obtain a third code value, and perform code conversion on the first port number to obtain a fourth code value; A processing module, configured to match a ternary content addressable memory TCAM table entry using the third coding value and / or the fourth coding value to obtain a matched access control list ACL rule; The TCAM table entry includes: a port domain range value and a port domain precise value, wherein the port domain range value is determined according to the port range value corresponding to the ACL rule, and the port domain precise value is determined according to the port precise value corresponding to the ACL rule; Wherein, when the value of the target port number is a range value, a target range code corresponding to the range value of the target port number is obtained according to the range database; the target range code is converted to obtain a first code value, the first code value is used as the port domain range value of the TCAM table entry, and the mask is used as the port domain precise value of the TCAM table entry; When the value of the target port number is an exact value, the exact value is converted to obtain a second coded value, the second coded value is used as the port domain exact value of the TCAM table entry, and the mask is used as the port domain range value of the TCAM table entry.

Images