A method, system, device and storage medium for processing ACL

Abstract

The present invention provides a method, system, device and storage medium for processing ACL, the method comprising: creating a structure for a chip ACL, and recording a chip ACL table item ID, a corresponding user ACL table item ID and a rule corresponding to the chip ACL table item in each structure, and generating a linked list according to all structures; in response to receiving a configuration request, determining whether the configuration request is a configuration binding point or a configuration rule; in response to the configuration request being a configuration binding point, processing the corresponding chip ACL according to the relationship between the binding point and the chip ACL table item rule; and in response to the configuration request being a configuration rule, processing the corresponding chip ACL according to the number of binding points. The present invention cuts off the possible dependency between binding points, has clearer logic, does not rely on specific chip implementation, and is easier to use for users.

Description

Technical Field

[0001] The present invention relates to the field of switches, and more specifically, to a method, system, device and storage medium for processing ACL. Background Art

[0002] Access Control List (ACL) is a common function of switches. It can control various behaviors of messages and plays an important role in the message processing pipeline of the switching chip. From the user's perspective, there are two prerequisites for ACL to take effect. One is to select the appropriate ACL matching rules, and the other is to select the appropriate ACL action. In the regulations of the open source project SONIC, in addition to ordinary rules, ACL rules also have a special type of rules, binding points. Binding points represent some commonly used matching rules, mainly including matching ports, matching aggregations, and matching VLANs (Virtual Local Area Networks). Port aggregation (trunk) is a common method for switches to increase bandwidth and link stability. Port aggregation usually contains multiple member ports. Because users will use a port aggregation as a port, the bandwidth and link stability of the "aggregation port" will be significantly improved compared to ordinary ports.

[0003] In the existing technical solutions, the ACL binding points and binding rules sent to the user are directly sent to the chip as configured by the user. The existing technology does not consider the interaction between binding points and the interaction between binding points and binding rules. Therefore, the final configuration effect depends greatly on the implementation of the chip. The following are two practical examples:

[0004] 1. Configure an ACL rule, select port 1 and port aggregation trunk 1 as the binding point, where port 1 is a member of trunk 1. Then unbind port 1, and the ACL will not take effect on port 1 of trunk 1. This is a serious problem, because in the eyes of the user, trunk 1 includes port 1. Since the user has bound trunk 1, the ACL rule must also take effect on port 1, a member of trunk 1.

[0005] 2. Configure an ACL rule, select vlan1 and port1 as the binding point. In the existing solution, the rule can only take effect when the traffic hits both vlan1 and port1. If the binding point selects two vlans: vlan1 and vlan2, the rule can take effect when the traffic hits either vlan1 or vlan2. This result is difficult for users to accept. Summary of the invention

[0006] In view of this, the purpose of the embodiments of the present invention is to propose a method, system, computer device and computer-readable storage medium for processing ACL. When a user configures an ACL table item with multiple binding points, or when a user adds a new binding point to an ACL table item with an existing binding point, the chip creates an ACL table item invisible to the user for each binding point. When the user deletes the ACL table item or unbinds it, the corresponding hardware ACL is found in the table to make corresponding adjustments.

[0007] Based on the above purpose, an embodiment of the present invention provides a method for processing ACL, comprising the following steps: creating a structure for a chip ACL, and recording a chip ACL table item ID, a corresponding user ACL table item ID, and a rule corresponding to the chip ACL table item in each structure, and generating a linked list according to all structures; in response to receiving a configuration request, determining whether the configuration request is a configuration binding point or a configuration rule; in response to the configuration request being a configuration binding point, processing the corresponding chip ACL according to the relationship between the binding point and the rule of the chip ACL table item; and in response to the configuration request being a configuration rule, processing the corresponding chip ACL according to the number of binding points.

[0008] In some implementations, processing the corresponding chip ACL according to the relationship between the binding point and the chip ACL table entry's rules includes: in response to the binding point and the chip ACL table entry's rules overlapping, no operation is performed; and in response to the binding point and the chip ACL table entry's rules not overlapping, creating or deleting the chip ACL corresponding to the binding point, and updating the linked list.

[0009] In some embodiments, the creation or deletion of the chip ACL corresponding to the binding point includes: in response to the configuration request to add a binding point, creating a chip ACL that can match the rules of the chip ACL table entry and the new binding point, and recording them in the linked list; and in response to the configuration request to delete the binding point, traversing the linked list, determining and deleting all chip ACLs that match the binding point and the corresponding linked list members.

[0010] In some embodiments, processing the corresponding chip ACL according to the number of binding points includes: in response to the absence of binding points, creating a chip ACL that meets user requirements or deleting the corresponding chip ACL table entry, and updating the linked list; and in response to the existence of binding points, creating a chip ACL table entry for each binding point or deleting the corresponding chip ACL, and updating the linked list.

[0011] In some embodiments, creating a chip ACL that meets user requirements or deleting a corresponding chip ACL table entry includes: in response to the configuration request to create a user ACL, configuring an ACL that meets user requirements in the chip, and enabling it on the chip in response to the ACL rules overlapping with the binding point function; and in response to the configuration request to delete the user ACL, deleting the corresponding chip ACL table entry and deleting the corresponding record from the linked list.

[0012] In some implementations, creating a chip ACL that meets user requirements or deleting a corresponding chip ACL entry includes: adding a new node to the linked list to record the corresponding relationship between the chip ACL and the user ACL.

[0013] In some implementations, creating a chip ACL entry for each binding point or deleting the corresponding chip ACL includes: in response to the configuration request to create a user ACL, creating a chip ACL entry for each binding point, and matching the user ACL rule to each chip ACL entry; and in response to the configuration request to delete the user ACL, determining the corresponding chip ACL entry ID in the linked list, and deleting the chip ACL according to the corresponding chip ACL entry ID.

[0014] Another aspect of an embodiment of the present invention provides a system for processing ACL, including: a linked list module, configured to create a structure for a chip ACL, and record a chip ACL table item ID, a corresponding user ACL table item ID, and a rule corresponding to the chip ACL table item in each structure, and generate a linked list based on all structures; a judgment module, configured to judge whether the configuration request is a configuration binding point or a configuration rule in response to receiving a configuration request; a first processing module, configured to process the corresponding chip ACL according to the relationship between the binding point and the rule of the chip ACL table item in response to the configuration request being a configuration binding point; and a second processing module, configured to process the corresponding chip ACL according to the number of binding points in response to the configuration request being a configuration rule.

[0015] According to another aspect of an embodiment of the present invention, a computer device is provided, comprising: at least one processor; and a memory, wherein the memory stores computer instructions executable on the processor, and the instructions implement the steps of the above method when executed by the processor.

[0016] According to another aspect of the embodiments of the present invention, a computer-readable storage medium is provided, which stores a computer program that implements the above method steps when executed by a processor.

[0017] The present invention has the following beneficial technical effects: when a user configures an ACL table item with multiple binding points, or when a user adds a new binding point to an ACL table item with an existing binding point, the chip creates an ACL table item invisible to the user for each binding point; when the user deletes the ACL table item or unbinds it, the corresponding hardware ACL is found by looking up the table to make corresponding adjustments, thereby severing possible dependencies between binding points, making the logic clearer, not dependent on specific chip implementation, and being easier to use for users. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other embodiments can be obtained based on these drawings without paying creative work.

[0019] Figure 1 A schematic diagram of an embodiment of a method for processing ACL provided by the present invention;

[0020] Figure 2 A schematic diagram of an embodiment of a system for processing ACL provided by the present invention;

[0021] Figure 3 A schematic diagram of the hardware structure of an embodiment of a computer device for processing ACL provided by the present invention;

[0022] Figure 4 A schematic diagram of an embodiment of a computer storage medium for processing ACL provided by the present invention. DETAILED DESCRIPTION

[0023] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the embodiments of the present invention are further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0024] It should be noted that all expressions using "first" and "second" in the embodiments of the present invention are for distinguishing two non-identical entities with the same name or non-identical parameters. It can be seen that "first" and "second" are only for the convenience of expression and should not be understood as limitations on the embodiments of the present invention. The subsequent embodiments will not explain this one by one.

[0025] A first aspect of the embodiments of the present invention provides an embodiment of a method for processing ACL. Figure 1 FIG. 1 is a schematic diagram of an embodiment of a method for processing ACL provided by the present invention. Figure 1 As shown, the embodiment of the present invention includes the following steps:

[0026] S1. Create a structure for the chip ACL, and record the chip ACL item ID, the corresponding user ACL item ID, and the rule corresponding to the chip ACL item in each structure, and generate a linked list based on all structures;

[0027] S2. In response to receiving a configuration request, determining whether the configuration request is a configuration binding point or a configuration rule;

[0028] S3, in response to the configuration request being to configure a binding point, processing the corresponding chip ACL according to the relationship between the binding point and the rule of the chip ACL table entry; and

[0029] S4. In response to the configuration request being a configuration rule, process a corresponding chip ACL according to the number of binding points.

[0030] In the embodiment of the present invention, when a user configures an ACL table item with multiple binding points, or when a user adds a new binding point to an ACL table item with an existing binding point, the chip creates an ACL table item invisible to the user for each binding point. When the user deletes the ACL table item or unbinds it, the corresponding hardware ACL is found in the table to make corresponding adjustments.

[0031] Create a structure based on the chip ACL entry ID, user ACL entry ID, binding point, and the rules corresponding to the chip entry. Create a structure for the chip ACL, and record the chip ACL entry ID, the corresponding user ACL entry ID, and the rules corresponding to the chip ACL entry in each structure, and generate a linked list based on all structures.

[0032] Each linked list member is an instance of the structure, corresponding to a chip ACL, recording the chip ACL item id and the corresponding user ACL item id corresponding to this ACL item, as well as the rules corresponding to the chip item (mainly ports, aggregations, and VLANs), and then modifying the corresponding process according to the user's possible ACL configuration scenarios. The structure that records ACL configuration information can be as follows:

[0033]

[0034]

[0035] In response to receiving a configuration request, it is determined whether the configuration request is to configure a binding point or a rule.

[0036] In response to the configuration request being to configure a binding point, the corresponding chip ACL is processed according to a relationship between the binding point and a rule of the chip ACL table entry.

[0037] In some implementations, processing the corresponding chip ACL according to the relationship between the binding point and the chip ACL table entry's rules includes: in response to the binding point and the chip ACL table entry's rules overlapping, no operation is performed; and in response to the binding point and the chip ACL table entry's rules not overlapping, creating or deleting the chip ACL corresponding to the binding point, and updating the linked list.

[0038] In some embodiments, the creation or deletion of the chip ACL corresponding to the binding point includes: in response to the configuration request to add a binding point, creating a chip ACL that can match the rules of the chip ACL table entry and the new binding point, and recording them in the linked list; and in response to the configuration request to delete the binding point, traversing the linked list, determining and deleting all chip ACLs that match the binding point and the corresponding linked list members.

[0039] If you are adding a binding point, first check whether the binding point and the table entry rule overlap. If they do, no operation is required. Otherwise, create a new chip ACL that can match both the ACL rule and the new binding point, and record it in the linked list.

[0040] If the operation is to delete the binding point, you also need to check whether the binding point and the table entry rules overlap. If they overlap, no operation is required because they have not been added. Otherwise, traverse the linked list, delete all chip ACL table entries that match the binding point, and clean up the linked list.

[0041] In response to the configuration request being a configuration rule, a corresponding chip ACL is processed according to the number of binding points.

[0042] In some embodiments, processing the corresponding chip ACL according to the number of binding points includes: in response to the absence of binding points, creating a chip ACL that meets user requirements or deleting the corresponding chip ACL table entry, and updating the linked list; and in response to the existence of binding points, creating a chip ACL table entry for each binding point or deleting the corresponding chip ACL, and updating the linked list.

[0043] In some embodiments, creating a chip ACL that meets user requirements or deleting a corresponding chip ACL table entry includes: in response to the configuration request to create a user ACL, configuring an ACL that meets user requirements in the chip, and enabling it on the chip in response to the ACL rules overlapping with the binding point function; and in response to the configuration request to delete the user ACL, deleting the corresponding chip ACL table entry and deleting the corresponding record from the linked list.

[0044] In some implementations, creating a chip ACL that meets user requirements or deleting a corresponding chip ACL entry includes: adding a new node to the linked list to record the corresponding relationship between the chip ACL and the user ACL.

[0045] Configure a user ACL without a binding point: If it is a create operation, configure an ACL that meets the user's requirements in the chip, and then check whether the ACL rule itself overlaps with the binding point function (the rule itself has matched the port, aggregation and VLAN). If so, enable it in the chip, otherwise do not enable it. Finally, record and add it to the linked list; if it is a delete operation, delete the corresponding chip ACL table entry. Finally, find and delete the record from the linked list.

[0046] In some implementations, creating a chip ACL entry for each binding point or deleting the corresponding chip ACL in the linked list includes: in response to the configuration request to create a user ACL, creating a chip ACL entry for each binding point, and matching the user ACL rule for each chip ACL entry; and in response to the configuration request to delete the user ACL, determining the corresponding chip ACL entry ID in the linked list, and deleting the chip ACL according to the corresponding chip ACL entry ID.

[0047] Configure a user ACL when there is already a binding point: If it is a creation operation, you need to create a chip ACL table entry for each binding point. Each table entry matches the binding point and the user ACL rule. If the rule itself has matched the port, aggregation and VLAN, and it does not overlap with the existing binding point, you also need to create an entry. Finally, all are added to the linked list; if it is a deletion operation, find the corresponding chip ACL table entry ID in the linked list, delete the chip ACL, and delete the record in the linked list.

[0048] According to the embodiments of the present invention, different scenarios are verified:

[0049] Verification scenario 1:

[0050] The first step is to configure the ACL list and ACL rule on the switch, bind the aggregation trunk1 and port port1, then add port1 to trunk1 and send packets that match the ACL rule. As a result, the ACL rule can take effect on the port.

[0051] In the second step, port1 is removed from trunk1. As a result, the ACL rule can still take effect on port1, which proves the effectiveness of the embodiment of the present invention.

[0052] Verification scenario 2:

[0053] The first step is to configure the ACL list and ACL rule on the switch, bind VLAN1 and port1 at the same time, then add VLAN1 to port1 and send packets that meet the ACL rule. As a result, the ACL rule can take effect on port1 and other member ports of VLAN1.

[0054] In the second step, all ports are deleted from vlan1, and as a result, the ACL rule can only take effect on port1, and cannot take effect on the ports removed from vlan1. This also proves the effectiveness of the embodiment of the present invention.

[0055] If the same type of binding points, such as ports, can be replaced by bitmaps, then there is no need to create multiple chip ACL entries when binding multiple ports. This is also true for VLAN and port aggregation.

[0056] In the embodiment of the present invention, when a user configures an ACL table item with multiple binding points, or when a user adds a new binding point to an ACL table item with an existing binding point, the chip creates an ACL table item invisible to the user for each binding point. When the user deletes the ACL table item or unbinds it, the corresponding hardware ACL is found in the table to make corresponding adjustments, thereby severing possible dependencies between binding points, making the logic clearer, not dependent on specific chip implementation, and easier to use for users.

[0057] It should be particularly pointed out that the various steps in the various embodiments of the above-mentioned method for processing ACL can be cross-linked, replaced, added, and deleted. Therefore, these reasonable permutations, combinations, and transformations of the method for processing ACL should also fall within the protection scope of the present invention, and the protection scope of the present invention should not be limited to the embodiments.

[0058] Based on the above purpose, the second aspect of the embodiment of the present invention provides a system for processing ACL. Figure 2 As shown, the system 200 includes the following modules: a linked list module, configured to create a structure for the chip ACL, and record the chip ACL table item ID, the corresponding user ACL table item ID and the rule corresponding to the chip ACL table item in each structure, and generate a linked list based on all structures; a judgment module, configured to judge whether the configuration request is a configuration binding point or a configuration rule in response to receiving a configuration request; a first processing module, configured to process the corresponding chip ACL according to the relationship between the binding point and the rule of the chip ACL table item in response to the configuration request being a configuration binding point; and a second processing module, configured to process the corresponding chip ACL according to the number of binding points in response to the configuration request being a configuration rule.

[0059] In some embodiments, the first processing module is configured to: in response to the binding point and the chip ACL table entry having overlapping rules, perform no operation; and in response to the binding point and the chip ACL table entry having non-overlapping rules, create or delete the chip ACL corresponding to the binding point and update the linked list.

[0060] In some embodiments, the first processing module is configured to: in response to the configuration request for adding a binding point, create a chip ACL that can match the rules of the chip ACL table entry and the new binding point, and record them in the linked list; and in response to the configuration request for deleting a binding point, traverse the linked list, determine and delete all chip ACLs that match the binding point and the corresponding linked list members.

[0061] In some embodiments, the second processing module is configured to: in response to the absence of a binding point, create a chip ACL that meets user requirements or delete the corresponding chip ACL table entry, and update the linked list; and in response to the existence of a binding point, create a chip ACL table entry for each binding point or delete the corresponding chip ACL, and update the linked list.

[0062] In some embodiments, the second processing module is configured to: in response to the configuration request to create a user ACL, configure an ACL that meets user requirements in the chip, and in response to the ACL rules overlapping with the binding point function, enable it on the chip; and in response to the configuration request to delete the user ACL, delete the corresponding chip ACL table entry and delete the corresponding record from the linked list.

[0063] In some implementations, the second processing module is configured to: add a new node to the linked list to record the corresponding relationship between the chip ACL and the user ACL.

[0064] In some embodiments, the second processing module is configured to: in response to the configuration request to create a user ACL, create a chip ACL table entry for each binding point, and match the user ACL rule to each chip ACL table entry; and in response to the configuration request to delete the user ACL, determine the corresponding chip ACL table entry ID in the linked list, and delete the chip ACL according to the corresponding chip ACL table entry ID.

[0065] Based on the above purpose, a third aspect of an embodiment of the present invention proposes a computer device, comprising: at least one processor; and a memory, the memory storing computer instructions that can be run on the processor, the instructions being executed by the processor to implement the following steps: S1, creating structures for chip ACL, and recording the chip ACL table item ID, the corresponding user ACL table item ID and the rule corresponding to the chip ACL table item in each structure, and generating a linked list based on all structures; S2, in response to receiving a configuration request, determining whether the configuration request is a configuration binding point or a configuration rule; S3, in response to the configuration request being a configuration binding point, processing the corresponding chip ACL according to the relationship between the binding point and the rule of the chip ACL table item; and S4, in response to the configuration request being a configuration rule, processing the corresponding chip ACL according to the number of binding points.

[0066] In some implementations, processing the corresponding chip ACL according to the relationship between the binding point and the chip ACL table entry's rules includes: in response to the binding point and the chip ACL table entry's rules overlapping, no operation is performed; and in response to the binding point and the chip ACL table entry's rules not overlapping, creating or deleting the chip ACL corresponding to the binding point, and updating the linked list.

[0067] In some embodiments, the creation or deletion of the chip ACL corresponding to the binding point includes: in response to the configuration request to add a binding point, creating a chip ACL that can match the rules of the chip ACL table entry and the new binding point, and recording them in the linked list; and in response to the configuration request to delete the binding point, traversing the linked list, determining and deleting all chip ACLs that match the binding point and the corresponding linked list members.

[0068] In some embodiments, processing the corresponding chip ACL according to the number of binding points includes: in response to the absence of binding points, creating a chip ACL that meets user requirements or deleting the corresponding chip ACL table entry, and updating the linked list; and in response to the existence of binding points, creating a chip ACL table entry for each binding point or deleting the corresponding chip ACL, and updating the linked list.

[0069] In some embodiments, creating a chip ACL that meets user requirements or deleting a corresponding chip ACL table entry includes: in response to the configuration request to create a user ACL, configuring an ACL that meets user requirements in the chip, and enabling it on the chip in response to the ACL rules overlapping with the binding point function; and in response to the configuration request to delete the user ACL, deleting the corresponding chip ACL table entry and deleting the corresponding record from the linked list.

[0070] In some implementations, creating a chip ACL that meets user requirements or deleting a corresponding chip ACL entry includes: adding a new node to the linked list to record the corresponding relationship between the chip ACL and the user ACL.

[0071] In some implementations, creating a chip ACL entry for each binding point or deleting the corresponding chip ACL includes: in response to the configuration request to create a user ACL, creating a chip ACL entry for each binding point, and matching the user ACL rule to each chip ACL entry; and in response to the configuration request to delete the user ACL, determining the corresponding chip ACL entry ID in the linked list, and deleting the chip ACL according to the corresponding chip ACL entry ID.

[0072] like Figure 3 FIG. 1 is a schematic diagram of the hardware structure of an embodiment of the computer device for processing ACL provided by the present invention.

[0073] As Figure 3 Taking the device shown as an example, the device includes a processor 301 and a memory 302.

[0074] The processor 301 and the memory 302 may be connected via a bus or other means. Figure 3 The example of connecting through bus is taken in the following.

[0075] The memory 302 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules, such as program instructions / modules corresponding to the method for processing ACL in the embodiment of the present application. The processor 301 executes various functional applications and data processing of the server by running the non-volatile software programs, instructions and modules stored in the memory 302, that is, implements the method for processing ACL.

[0076] The memory 302 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required by at least one function; the data storage area may store data created according to the use of the method for processing ACL, etc. In addition, the memory 302 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 302 may optionally include a memory remotely arranged relative to the processor 301, and these remote memories may be connected to the local module via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0077] Computer instructions 303 corresponding to one or more methods for processing ACL are stored in the memory 302 , and when executed by the processor 301 , the method for processing ACL in any of the above method embodiments is executed.

[0078] Any embodiment of the computer device that executes the above-mentioned method for processing ACL can achieve the same or similar effect as any corresponding embodiment of the above-mentioned method.

[0079] The present invention also provides a computer-readable storage medium, which stores a computer program for executing the method for processing ACL when executed by a processor.

[0080] like Figure 4 FIG. 1 is a schematic diagram of an embodiment of the computer storage medium for processing ACL provided by the present invention. Figure 4 Taking the computer storage medium shown as an example, the computer readable storage medium 401 stores a computer program 402 that performs the above method when executed by a processor.

[0081] Finally, it should be noted that a person skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program of the method for processing ACL can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the storage medium of the program can be a disk, an optical disk, a read-only storage memory (ROM) or a random access memory (RAM), etc. The above-mentioned computer program embodiments can achieve the same or similar effects as the corresponding any of the above-mentioned method embodiments.

[0082] The above are exemplary embodiments disclosed in the present invention, but it should be noted that various changes and modifications may be made without departing from the scope disclosed in the embodiments of the present invention as defined in the claims. The functions, steps and / or actions of the method claims according to the disclosed embodiments described herein do not need to be performed in any particular order. In addition, although the elements disclosed in the embodiments of the present invention may be described or required in individual form, they may also be understood as multiple unless explicitly limited to the singular.

[0083] It should be understood that, as used herein, the singular forms "a", "an" are intended to include the plural forms as well, unless the context clearly supports an exception. It should also be understood that, as used herein, "and / or" refers to any and all possible combinations including one or more of the associated listed items.

[0084] The serial numbers of the embodiments disclosed in the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0085] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0086] A person skilled in the art should understand that the discussion of any of the above embodiments is only exemplary and is not intended to imply that the scope of the disclosure of the embodiments of the present invention (including the claims) is limited to these examples; under the concept of the embodiments of the present invention, the technical features in the above embodiments or different embodiments can also be combined, and there are many other changes in different aspects of the embodiments of the present invention as above, which are not provided in detail for the sake of simplicity. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present invention should be included in the protection scope of the embodiments of the present invention.

Claims

1. A method for processing ACL, characterized in that: The steps include: Create a structure for the chip ACL, and record the chip ACL item ID, the corresponding user ACL item ID, and the rule corresponding to the chip ACL item in each structure, and generate a linked list based on all structures; In response to receiving a configuration request, determining whether the configuration request is to configure a binding point or a configuration rule; In response to the configuration request being to configure a binding point and the binding point coincides with a rule of a chip ACL entry, no operation is performed; In response to the configuration request being to configure a binding point and the binding point does not overlap with the rule of the chip ACL table entry, creating or deleting the chip ACL corresponding to the binding point, and updating the linked list; In response to the configuration request being a configuration rule and having no binding point, creating a chip ACL or deleting a corresponding chip ACL table entry, and updating the linked list; In response to the configuration request being a configuration rule and the existence of a binding point, a chip ACL table entry is created for each binding point or the corresponding chip ACL is deleted, and the linked list is updated.

2. The method according to claim 1, characterized in that The step of creating or deleting a chip ACL corresponding to a binding point includes: In response to the configuration request for adding a binding point, creating a chip ACL that can match the rules of the chip ACL table entry and the new binding point, and recording them in the linked list; and In response to the configuration request to delete a binding point, the linked list is traversed to determine and delete all chip ACLs and corresponding linked list members that match the binding point.

3. The method according to claim 1, characterized in that The step of creating a chip ACL or deleting a corresponding chip ACL entry includes: In response to the configuration request being to create a user ACL, configuring the ACL in the chip, and in response to the rule of the ACL being coincident with the binding point function, enabling it in the chip; and In response to the configuration request being to delete the user ACL, the corresponding chip ACL table entry is deleted and the corresponding record is deleted from the linked list.

4. The method according to claim 3, characterized in that The step of creating a chip ACL or deleting a corresponding chip ACL entry includes: A new node is added to the linked list to record the corresponding relationship between the chip ACL and the user ACL.

5. The method according to claim 1, characterized in that Creating a chip ACL table entry for each binding point or deleting the corresponding chip ACL includes: In response to the configuration request to create a user ACL, create a chip ACL table entry for each binding point, and match the user ACL rule to each chip ACL table entry; and In response to the configuration request being to delete the user ACL, a corresponding chip ACL table entry ID is determined in the linked list, and the chip ACL is deleted according to the corresponding chip ACL table entry ID.

6. A system for processing ACL, characterized in that: include: A linked list module is configured to create structures for chip ACL, and record the chip ACL entry ID, the corresponding user ACL entry ID and the rule corresponding to the chip ACL entry in each structure, and generate a linked list based on all structures; A determination module configured to, in response to receiving a configuration request, determine whether the configuration request is a configuration binding point or a configuration rule; The first processing module is configured to, in response to the configuration request being to configure a binding point and the binding point and the chip ACL table item have the same rule, not perform any operation; in response to the configuration request being to configure a binding point and the binding point and the chip ACL table item have no same rule, create or delete the chip ACL corresponding to the binding point, and update the linked list; as well as The second processing module is configured to create a chip ACL or delete a corresponding chip ACL table entry in response to the configuration request being a configuration rule and having no binding point, and update the linked list; in response to the configuration request being a configuration rule and having a binding point, create a chip ACL table entry for each binding point or delete the corresponding chip ACL, and update the linked list.

7. A computer device, characterized in that: include: at least one processor; as well as A memory storing computer instructions executable on the processor, wherein the instructions, when executed by the processor, implement the steps of the method according to any one of claims 1 to 5.

8. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images