Acl processing apparatus and method, forwarding chip, network device

Abstract

An access control list (ACL) processing device and method, a forwarding chip and a network device belong to the technical field of network. The ACL processing device comprises an acquisition unit, a construction unit and a lookup unit. The acquisition unit is configured to acquire a basic information set according to first message information. The construction unit is configured to construct first key information according to the basic information set. The lookup unit is configured to look up an ACL rule library according to the first key information. The acquisition unit is further configured to extract fixed information of a first protocol layer from the first message information, and extract flexible information from the first message information according to user configuration information. The basic information in the basic information set comprises the fixed information and the flexible information. The application can reduce resource consumption of the ACL processing device, and improve flexibility and expansion capability of the ACL processing device.

Description

TECHNICAL FIELD

[0001] The present application relates to the network technical field, in particular to an access control list (ACL) processing device and method, a forwarding chip and a network device. BACKGROUND

[0002] The forwarding chip in the network device usually includes an ACL processing device, which is used for processing a packet according to an ACL rule to perform operations such as packet filtering, packet redirection, flow statistics, priority mapping, flow monitoring and rate limiting.

[0003] The current ACL processing device includes a configurable ACL processing device and a fixed ACL processing device. The configurable ACL processing device is configurable, can be flexibly applied to various service scenarios and has good expansion capability, but has large resource overhead. The function of the fixed ACL processing device is fixed, and the resource overhead is small, but the flexibility and expansion capability are poor. Therefore, how to reduce the resource overhead while ensuring the flexibility and expansion capability of the ACL processing device is a problem to be solved. SUMMARY

[0004] The present application provides an ACL processing device and method, a forwarding chip and a network device, which helps to reduce the resource overhead of the ACL processing device and improve the flexibility and expansion capability of the ACL processing device. The technical solutions of the present application are as follows:

[0005] In a first aspect, an ACL processing device is provided, which is applied to a forwarding chip, and includes an acquisition unit, a construction unit and a lookup unit, which are connected in sequence; the acquisition unit is configured to acquire a basic information set according to first packet information, the first packet information is information related to a first packet, and the basic information set includes at least one basic information related to the first packet; the construction unit is configured to construct first key information according to the basic information set, and the first key information includes at least one basic information in the basic information set; and the lookup unit is configured to look up an ACL rule library according to the first key information. In addition, the acquisition unit is further configured to extract fixed information of a first protocol layer from the first packet information, extract flexible information from the first packet information according to user configuration information, and the basic information in the basic information set includes the flexible information and the fixed information of the first protocol layer.

[0006] The technical scheme provided in the application, since the obtaining unit in the ACL processing device can extract fixed information of the first protocol layer, the obtaining unit comprises fixed extraction function, and since the obtaining unit can extract flexible information from the first message information according to user configuration information, the obtaining unit comprises configurable extraction function. Since the obtaining unit comprises fixed extraction function and configurable extraction function, the flexibility and expansion capability of the obtaining unit are high and the resource consumption is small, so that the flexibility and expansion capability of the ACL processing device are high and the resource consumption is small.

[0007] Optionally, the obtaining unit comprises a configurable extraction module and a first fixed extraction module, the first fixed extraction module can correspond to the first protocol layer, and the first fixed extraction module is used for extracting fixed information of the first protocol layer from the first message information; the configurable extraction module is used for extracting flexible information from the first message information.

[0008] The technical scheme provided in the application, the function of the configurable extraction module in the obtaining unit is configurable, so that the flexibility and expansion capability of the configurable extraction module are high, and the flexibility and expansion capability of the obtaining unit are high. The function of the first fixed extraction module in the obtaining unit is fixed, so that the resource consumption of the first fixed extraction module is small, and the resource consumption of the obtaining unit is small.

[0009] Optionally, the obtaining unit is further used for extracting target information of a first message type from the first message information, the first message type belongs to the first protocol layer; and determining the fixed information of the first protocol layer according to the first type information and the target information of the first message type, the first type information being used for indicating the message type of the first message corresponding to the first protocol layer.

[0010] Optionally, the first fixed extraction module is further used for extracting target information of a first message type from the first message information, the first message type belonging to the first protocol layer; and determining the fixed information of the first protocol layer according to the first type information and the target information of the first message type, the first type information being used for indicating the message type of the first message corresponding to the first protocol layer.

[0011] Optionally, the first fixed extraction module comprises a first selection submodule and at least one first fixed extraction submodule, the at least one first fixed extraction submodule is connected with the first selection submodule, the at least one first fixed extraction submodule one-to-one corresponds to at least one first message type, the at least one first message type belongs to the first protocol layer; each first fixed extraction submodule in the at least one first fixed extraction submodule is used for extracting target information of a first message type corresponding to the each first fixed extraction submodule from the first message information; and the first selection submodule is used for determining the fixed information of the first protocol layer according to the first type information and the target information extracted from the first message information by the at least one first fixed extraction submodule.

[0012] Optionally, the obtaining unit is further configured to extract the fixed information of the second protocol layer from the first message information, and the basic information in the basic information set further comprises the fixed information of the second protocol layer.

[0013] The technical scheme provided in the application, since the obtaining unit in the ACL processing device can extract the fixed information of the second protocol layer, the obtaining unit comprises a fixed extraction function, and the resource consumption of the obtaining unit is small.

[0014] Optionally, the obtaining unit comprises a second fixed extraction module, the second fixed extraction module can be fixed to the second protocol layer, and the second fixed extraction module is configured to extract the fixed information of the second protocol layer from the first message information, and the basic information in the basic information set further comprises the fixed information of the second protocol layer.

[0015] The technical scheme provided in the application, the function of the second fixed extraction module in the obtaining unit is fixed, so that the resource consumption of the second fixed extraction module is small, and the resource consumption of the obtaining unit is small.

[0016] Optionally, the obtaining unit is further configured to extract target information of a second message type from the first message information, the second message type belongs to the second protocol layer, and the fixed information of the second protocol layer is determined according to the second type information and the target information of the second message type, the second type information being used to indicate the message type of the first message corresponding to the second protocol layer.

[0017] Optionally, the second fixed extraction module is further configured to extract target information of a second message type from the first message information, the second message type belongs to the second protocol layer, and the fixed information of the second protocol layer is determined according to the second type information and the target information of the second message type, the second type information being used to indicate the message type of the first message corresponding to the second protocol layer.

[0018] Optionally, the second fixed extraction module comprises a second selection submodule and at least one second fixed extraction submodule, the at least one second fixed extraction submodule is connected with the second selection submodule, the at least one second fixed extraction submodule one-to-one corresponds to at least one second message type, the at least one second message type belongs to the second protocol layer, each second fixed extraction submodule in the at least one second fixed extraction submodule is configured to extract target information of a second message type corresponding to the second fixed extraction submodule from the first message information, and the second selection submodule is configured to determine the fixed information of the second protocol layer according to the second type information and the target information extracted from the first message information by the at least one second fixed extraction submodule.

[0019] Optionally, the obtaining unit comprises a plurality of fixed extraction modules, the plurality of fixed extraction modules are fixedly corresponding to a plurality of protocol layers, the plurality of fixed extraction modules comprise a first fixed extraction module and a second fixed extraction module; each fixed extraction module in the plurality of fixed extraction modules is configured to extract fixed information of a protocol layer corresponding to the each fixed extraction module from the first message information, and the basic information in the basic information set comprises the fixed information extracted from the first message information by the plurality of fixed extraction modules.

[0020] The technical scheme provided in the application, the obtaining unit comprises a plurality of fixed extraction modules, the functions of the plurality of fixed extraction modules are fixed, and therefore the resource consumption of the plurality of fixed extraction modules is small, so that the resource consumption of the obtaining unit is small.

[0021] Optionally, each fixed extraction module in the plurality of fixed extraction modules comprises a selection submodule and at least one fixed extraction submodule, the at least one fixed extraction submodule is connected with the selection submodule, the at least one fixed extraction submodule is one-to-one corresponding to at least one message type, and the at least one message type belongs to a protocol layer corresponding to the each fixed extraction module; each fixed extraction submodule in the at least one fixed extraction submodule is configured to extract target information of a message type corresponding to the each fixed extraction submodule from the first message information; and the selection submodule is configured to determine fixed information of a protocol layer corresponding to the each fixed extraction module according to type information of the first message corresponding to the each fixed extraction module and the target information extracted from the first message information by the at least one fixed extraction submodule, and the type information of the first message corresponding to the each fixed extraction module is used to indicate a message type of the first message corresponding to the protocol layer corresponding to the each fixed extraction module.

[0022] Optionally, the configurable extraction module comprises a plurality of configurable extraction submodules, at least two configurable extraction submodules in the plurality of configurable extraction submodules are different in bit width; each configurable extraction submodule in the plurality of configurable extraction submodules is configured to extract flexible information from the first message information according to user configuration information and the bit width of the each configurable extraction submodule, and the basic information in the basic information set comprises the flexible information extracted from the first message information by the plurality of configurable extraction submodules.

[0023] The technical scheme provided in the application, the obtaining unit comprises a configurable extraction module, the configurable extraction module comprises at least two configurable extraction submodules, and the at least two configurable extraction submodules are different in bit width, so that the configurable extraction module can extract flexible information from the first message information according to user configuration information and different bit widths, the flexibility of the configurable extraction module is high, the flexibility of the obtaining unit is high, and the flexibility of the ACL processing device is high.

[0024] Optionally, the ACL processing apparatus further comprises an arbitration unit; the construction unit is further configured to construct second key information according to the set of basic information, the second key information comprising at least one of the set of basic information; the searching unit is further configured to search the ACL rule library according to the second key information; and the arbitration unit is configured to arbitrate first behavior information and second behavior information, the first behavior information being behavior information obtained by the searching unit searching the ACL rule library according to the first key information, and the second behavior information being behavior information obtained by the searching unit searching the ACL rule library according to the second key information. For example, the first behavior information and the second behavior information each comprise a plurality of behavior information, and the arbitration unit arbitrates the first behavior information and the second behavior information by de-duplication and merging, so as to arbitrate the first behavior information and the second behavior information. Since the first behavior information and the second behavior information each comprise a plurality of behavior information, the first behavior information and the second behavior information can each be a set of behavior information, for example, the first behavior information is a first set of behavior information, and the second behavior information is a second set of behavior information.

[0025] Optionally, the first behavior information and the second behavior information each comprise fixed behavior information and flexible behavior information, and the arbitration unit is further configured to arbitrate the fixed behavior information included in the first behavior information and the fixed behavior information included in the second behavior information, and arbitrate the flexible behavior information included in the first behavior information and the flexible behavior information included in the second behavior information.

[0026] The technical scheme provided in the application has the advantages that, since the arbitration unit can arbitrate the fixed behavior information and the flexible behavior information respectively, the arbitration unit comprises fixed arbitration functions and configurable arbitration functions, the arbitration unit has high flexibility and expansion capability, and the arbitration unit has low resource consumption.

[0027] Optionally, the arbitration unit comprises a fixed arbitration module and a configurable arbitration module, the fixed arbitration module is configured to arbitrate the fixed behavior information included in the first behavior information and the fixed behavior information included in the second behavior information, and the configurable arbitration module is configured to arbitrate the flexible behavior information included in the first behavior information and the flexible behavior information included in the second behavior information.

[0028] The technical scheme provided in the application has the advantages that, since the arbitration unit comprises the fixed arbitration module and the configurable arbitration module, the function of the fixed arbitration module is fixed, so the fixed arbitration module has low resource consumption, and the arbitration unit has low resource consumption. The function of the configurable arbitration module is configurable, so the configurable arbitration module has high flexibility and expansion capability, and the arbitration unit has high flexibility and expansion capability.

[0029] Optionally, the ACL processing apparatus further comprises a decoding unit, configured to normalize the first behavior information and the second behavior information; and the arbitration unit is configured to arbitrate the normalized first behavior information and the normalized second behavior information. The decoding unit normalizes the first behavior information and the second behavior information, so that the format of the first behavior information and the format of the second behavior information are unified, and the arbitration unit is facilitated to arbitrate the first behavior information and the second behavior information.

[0030] Optionally, the first behavior information and the second behavior information respectively comprise fixed behavior information and flexible behavior information, and the decoding unit is configured to normalize the fixed behavior information comprised in the first behavior information and the fixed behavior information comprised in the second behavior information, and normalize the flexible behavior information comprised in the first behavior information and the flexible behavior information comprised in the second behavior information.

[0031] The decoding unit can normalize the fixed behavior information and the flexible behavior information respectively, so that the decoding unit comprises fixed decoding function and configurable decoding function, the flexibility and the expansion capability of the decoding unit are higher, and the resource consumption of the decoding unit is smaller.

[0032] Optionally, the decoding unit comprises a first decoding module and a second decoding module, the first decoding module is configured to normalize the first behavior information, and the second decoding module is configured to normalize the second behavior information.

[0033] Optionally, the first behavior information comprises fixed behavior information and flexible behavior information, and the first decoding module is further configured to normalize the fixed behavior information comprised in the first behavior information, and normalize the flexible behavior information comprised in the first behavior information.

[0034] The first decoding module can normalize the fixed behavior information and the flexible behavior information respectively, so that the first decoding module comprises fixed decoding function and configurable decoding function, the flexibility and the expansion capability of the first decoding module are higher, and the resource consumption of the first decoding module is smaller.

[0035] Optionally, the first decoding module comprises a fixed decoding submodule and a configurable decoding submodule, the fixed decoding submodule is configured to normalize the fixed behavior information comprised in the first behavior information, and the configurable decoding submodule is configured to normalize the flexible behavior information comprised in the first behavior information.

[0036] The technical scheme provided in the application, since the first decoding module comprises a fixed decoding submodule and a configurable decoding submodule, the function of the fixed decoding submodule is fixed, and therefore the resource consumption of the fixed decoding submodule is small, and the resource consumption of the first decoding module is small. The function of the configurable decoding submodule is configurable, and therefore the flexibility and expansion capability of the configurable decoding submodule are high, and the flexibility and expansion capability of the first decoding module are high.

[0037] Optionally, the second behavior information comprises fixed behavior information and flexible behavior information, and the second decoding module is further configured to normalize the fixed behavior information comprised in the second behavior information; and normalize the flexible behavior information comprised in the second behavior information.

[0038] The technical scheme provided in the application, since the second decoding module can normalize the fixed behavior information and the flexible behavior information respectively, the second decoding module comprises a fixed decoding function and a configurable decoding function, the flexibility and expansion capability of the second decoding module are high, and the resource consumption of the second decoding module is small.

[0039] Optionally, the second decoding module comprises a fixed decoding submodule and a configurable decoding submodule; the fixed decoding submodule is configured to normalize the fixed behavior information comprised in the second behavior information; and the configurable decoding submodule is configured to normalize the flexible behavior information comprised in the second behavior information.

[0040] The technical scheme provided in the application, since the second decoding module comprises a fixed decoding submodule and a configurable decoding submodule, the function of the fixed decoding submodule is fixed, and therefore the resource consumption of the fixed decoding submodule is small, and the resource consumption of the second decoding module is small. The function of the configurable decoding submodule is configurable, and therefore the flexibility and expansion capability of the configurable decoding submodule are high, and the flexibility and expansion capability of the second decoding module are high.

[0041] Optionally, the construction unit comprises a first construction module and a second construction module; the first construction module is configured to construct the first key information according to the basic information set; and the second construction module is configured to construct the second key information according to the basic information set.

[0042] Optionally, the construction unit is further configured to construct a plurality of key information according to the basic information set, the plurality of key information comprising the first key information and the second key information; the searching unit is further configured to search the ACL rule library according to the plurality of key information, to obtain a plurality of target behavior information corresponding to the plurality of key information, the plurality of target behavior information comprising the first behavior information and the second behavior information; and the arbitration unit is configured to arbitrate the plurality of target behavior information.

[0043] Optionally, the constructing unit comprises a plurality of constructing modules, the plurality of constructing modules are configured to construct the plurality of key information according to the basic information set, and the plurality of key information correspond to the plurality of constructing modules one by one.

[0044] Optionally, at least two of the plurality of target behavior information comprise fixed behavior information and flexible behavior information; the arbitration unit is configured to arbitrate the fixed behavior information comprised in the plurality of target behavior information; and arbitrate the flexible behavior information comprised in the plurality of target behavior information.

[0045] Optionally, the arbitration unit comprises a fixed arbitration module and a configurable arbitration module, the fixed arbitration module is configured to arbitrate the fixed behavior information comprised in the plurality of target behavior information; and the configurable arbitration module is configured to arbitrate the flexible behavior information comprised in the plurality of target behavior information.

[0046] Optionally, the ACL processing apparatus further comprises a decoding unit, the decoding unit is configured to normalize the plurality of target behavior information; and the arbitration unit is configured to arbitrate the normalized plurality of target behavior information.

[0047] Optionally, the decoding unit comprises a plurality of decoding modules, the plurality of decoding modules correspond to the plurality of constructing modules one by one; and the plurality of decoding modules are configured to normalize the plurality of target behavior information one by one.

[0048] Optionally, the arbitration unit arbitrates the first behavior information and the second behavior information to obtain arbitration behavior information, and the ACL processing apparatus further comprises an execution unit configured to execute an operation behavior indicated by the arbitration behavior information for the first packet.

[0049] Optionally, the first fixed extracting module comprises an application specific integrated circuit (ASIC). The second fixed extracting module comprises an ASIC. For example, at least a first fixed extracting submodule comprised in the first fixed extracting module is implemented by using an ASIC, and at least a second fixed extracting submodule comprised in the second fixed extracting module is implemented by using an ASIC.

[0050] Optionally, the first message information comprises one or more of: message header information of the first message, forwarding information of the first message. The message header information of the first message is information carried by a message header of the first message, including but not limited to information carried by a layer 2 (L2) message header of the first message, information carried by a layer 3 (L3) message header of the first message, information carried by a layer 4 (L4) message header of the first message, etc. The forwarding information of the first message is information related to the first message obtained by a forwarding chip through any possible way such as table lookup and analysis during forwarding of the first message by the forwarding chip.

[0051] In a second aspect, an ACL processing method is provided, comprising: obtaining a basic information set according to first message information, the first message information being information related to a first message, the basic information set comprising at least one basic information related to the first message; constructing first key information according to the basic information set, the first key information comprising at least one basic information in the basic information set; and searching an ACL rule library according to the first key information; wherein the obtaining of the basic information set according to the first message information comprises: extracting fixed information of a first protocol layer from the first message information, and extracting flexible information from the first message information according to user configuration information, the basic information in the basic information set comprising the fixed information and the flexible information.

[0052] Optionally, the extracting of the fixed information of the first protocol layer from the first message information comprises: extracting target information of a first message type from the first message information, the first message type belonging to the first protocol layer; and determining the fixed information of the first protocol layer according to the first type information and the target information of the first message type, the first type information being used to indicate a message type of the first message corresponding to the first protocol layer.

[0053] Optionally, the obtaining of the basic information set according to the first message information further comprises: extracting fixed information of a second protocol layer from the first message information, the basic information in the basic information set further comprising the fixed information of the second protocol layer.

[0054] Optionally, the extracting of the fixed information of the second protocol layer from the first message information comprises: extracting target information of a second message type from the first message information, the second message type belonging to the second protocol layer; and determining the fixed information of the second protocol layer according to the second type information and the target information of the second message type, the second type information being used to indicate a message type of the first message corresponding to the second protocol layer.

[0055] Optionally, the method further comprises: constructing a second key information according to the basic information set, the second key information comprising at least one basic information in the basic information set; searching the ACL rule library according to the second key information; arbitrating the first behavior information and the second behavior information, the first behavior information being behavior information obtained by searching the ACL rule library according to the first key information, and the second behavior information being behavior information obtained by searching the ACL rule library according to the second key information.

[0056] Optionally, the first behavior information and the second behavior information respectively comprise fixed behavior information and flexible behavior information; arbitrating the first behavior information and the second behavior information comprises: arbitrating the fixed behavior information comprised in the first behavior information and the fixed behavior information comprised in the second behavior information; arbitrating the flexible behavior information comprised in the first behavior information and the flexible behavior information comprised in the second behavior information.

[0057] Optionally, the method further comprises: normalizing the first behavior information and the second behavior information.

[0058] Correspondingly, arbitrating the first behavior information and the second behavior information comprises: arbitrating the normalized first behavior information and the normalized second behavior information.

[0059] Optionally, constructing the first key information according to the basic information set comprises: constructing a plurality of key information according to the basic information set, the plurality of key information comprising the first key information.

[0060] Searching the ACL rule library according to the first key information comprises: searching the ACL rule library according to the plurality of key information, obtaining a plurality of target behavior information corresponding to the plurality of key information, the plurality of target behavior information comprising the first behavior information and the second behavior information.

[0061] Arbitrating the first behavior information and the second behavior information comprises: arbitrating the plurality of target behavior information.

[0062] Optionally, arbitrating the first behavior information and the second behavior information obtains an arbitration behavior information, and the method further comprises:

[0063] Performing an operation behavior indicated by the arbitration behavior information on the first packet.

[0064] Optionally, the first packet information comprises one or more of the following: packet header information of the first packet, forwarding information of the first packet.

[0065] In a third aspect, an ACL processing method is provided, which is applied to an ACL processing device including an obtaining unit, a constructing unit and a searching unit. The method comprises: obtaining, by the obtaining unit, a basic information set according to first packet information, the first packet information being information related to a first packet, and the basic information set including at least one basic information related to the first packet; constructing, by the constructing unit, first key information according to the basic information set, the first key information including at least one basic information in the basic information set; and searching, by the searching unit, an ACL rule library according to the first key information.

[0066] In an embodiment, the obtaining unit obtains the basic information set according to the first packet information, including: the obtaining unit extracts fixed information of a first protocol layer from the first packet information, and the obtaining unit extracts flexible information from the first packet information according to user configuration information, wherein the basic information in the basic information set includes the fixed information and the flexible information.

[0067] Optionally, the obtaining unit includes a configurable extraction module and a first fixed extraction module, the first fixed extraction module is fixed to correspond to a second protocol layer, and the obtaining unit extracts the fixed information of the first protocol layer from the first packet information, including: the first fixed extraction module extracts the fixed information of the first protocol layer from the first packet information; and the obtaining unit extracts the flexible information from the first packet information according to the user configuration information, including: the configurable extraction module extracts the flexible information from the first packet information according to the user configuration information.

[0068] Optionally, the obtaining unit extracts the fixed information of the first protocol layer from the first packet information, including: the obtaining unit extracts target information of a first packet type from the first packet information, the first packet type belonging to the first protocol layer; and the obtaining unit determines the fixed information of the first protocol layer according to the first type information and the target information of the first packet type, the first type information being used to indicate a packet type of the first packet corresponding to the first protocol layer.

[0069] Optionally, the first fixed extraction module extracts the fixed information of the first protocol layer from the first packet information, including: the first fixed extraction module extracts target information of a first packet type from the first packet information, the first packet type belonging to the first protocol layer; and the first fixed extraction module determines the fixed information of the first protocol layer according to the first type information and the target information of the first packet type, the first type information being used to indicate a packet type of the first packet corresponding to the first protocol layer.

[0070] Optionally, the first fixed extraction module comprises a first selection submodule and at least one first fixed extraction submodule, the at least one first fixed extraction submodule one-to-one corresponds to at least one first message type, the at least one first message type belongs to the first protocol layer; the first fixed extraction module extracts target information of the first message type from the first message information, comprising: each first fixed extraction submodule in the at least one first fixed extraction submodule extracts target information of the first message type corresponding to the each first fixed extraction submodule from the first message information; the first fixed extraction module determines fixed information of the first protocol layer according to the first type information and the target information of the first message type, comprising: the first selection submodule determines the fixed information of the first protocol layer according to the first type information and the target information extracted from the first message information by the at least one first fixed extraction submodule, and the first type information is used to indicate the message type of the first message corresponding to the first protocol layer.

[0071] Optionally, the acquisition unit acquires the basic information set according to the first message information, and further comprises: the acquisition unit extracts the fixed information of the second protocol layer from the first message information, and the basic information in the basic information set further comprises the fixed information of the second protocol layer.

[0072] Optionally, the acquisition unit comprises a second fixed extraction module, the second fixed extraction module corresponds to the second protocol layer; the acquisition unit acquires the basic information set according to the first message information, and further comprises: the second fixed extraction module extracts the fixed information of the second protocol layer from the first message information, and the basic information in the basic information set further comprises the fixed information of the second protocol layer.

[0073] Optionally, the acquisition unit extracts the fixed information of the second protocol layer from the first message information, comprising: the acquisition unit extracts target information of a second message type from the first message information, the second message type belongs to the second protocol layer; the acquisition unit determines the fixed information of the second protocol layer according to the second type information and the target information of the second message type, and the second type information is used to indicate the message type of the first message corresponding to the second protocol layer.

[0074] Optionally, the second fixed extraction module extracts the fixed information of the second protocol layer from the first message information, comprising: the second fixed extraction module extracts target information of a second message type from the first message information, the second message type belongs to the second protocol layer; the second fixed extraction module determines the fixed information of the second protocol layer according to the second type information and the target information of the second message type, and the second type information is used to indicate the message type of the first message corresponding to the second protocol layer.

[0075] Optionally, the second fixed extraction module comprises a second selection submodule and at least one second fixed extraction submodule, the at least one second fixed extraction submodule one-to-one corresponding to at least one second message type, the at least one second message type belonging to the second protocol layer; the second fixed extraction module extracts target information of the second message type from the first message information, comprising: each second fixed extraction submodule in the at least one second fixed extraction submodule extracts target information of the second message type corresponding to the each second fixed extraction submodule from the first message information; the second fixed extraction module determines fixed information of the second protocol layer according to the second type information and the target information of the second message type, comprising: the second selection submodule determines fixed information of the second protocol layer according to the second type information and the target information extracted from the first message information by the at least one second fixed extraction submodule, the second type information being used to indicate a message type of the first message corresponding to the second protocol layer.

[0076] Optionally, the acquisition unit comprises a plurality of fixed extraction modules, the plurality of fixed extraction modules fixed one-to-one corresponding to a plurality of protocol layers, the plurality of fixed extraction modules comprising a first fixed extraction module and a second fixed extraction module; the acquisition unit acquires a basic information set according to the first message information, comprising: each fixed extraction module in the plurality of fixed extraction modules extracts fixed information of a protocol layer corresponding to the each fixed extraction module from the first message information, the basic information in the basic information set comprising the fixed information extracted from the first message information by the plurality of fixed extraction modules.

[0077] Optionally, each fixed extraction module in the plurality of fixed extraction modules comprises a selection submodule and at least one fixed extraction submodule, the at least one fixed extraction submodule one-to-one corresponding to at least one message type, the at least one message type belonging to a protocol layer corresponding to the each fixed extraction module; each fixed extraction module in the plurality of fixed extraction modules extracts fixed information of a protocol layer corresponding to the each fixed extraction module from the first message information, comprising: each fixed extraction submodule in the at least one fixed extraction submodule extracts target information of a message type corresponding to the each fixed extraction submodule from the first message information; the selection submodule determines fixed information of the protocol layer corresponding to the each fixed extraction module according to type information of the first message corresponding to the each fixed extraction module and the target information extracted from the first message information by the at least one fixed extraction submodule, the type information of the first message corresponding to the each fixed extraction module being used to indicate a message type of the first message corresponding to the protocol layer corresponding to the each fixed extraction module.

[0078] Optionally, the configurable extraction module comprises a plurality of configurable extraction sub-modules, bit widths of at least two configurable extraction sub-modules in the plurality of configurable extraction sub-modules are different; the configurable extraction module extracts flexible information from the first packet information according to the user configuration information, comprising: each configurable extraction sub-module in the plurality of configurable extraction sub-modules extracts flexible information from the first packet information according to the user configuration information and the bit width of the each configurable extraction sub-module, the basic information in the basic information set comprises the flexible information extracted from the first packet information by the plurality of configurable extraction sub-modules.

[0079] Optionally, the ACL processing apparatus further comprises an arbitration unit, and the method further comprises: constructing, by the constructing unit, second key information according to the basic information set, the second key information comprising at least one basic information in the basic information set; searching, by the searching unit, the ACL rule library according to the second key information; arbitrating, by the arbitration unit, first behavior information and second behavior information, the first behavior information being behavior information obtained by the searching unit according to the first key information, and the second behavior information being behavior information obtained by the searching unit according to the second key information.

[0080] Optionally, the first behavior information and the second behavior information respectively comprise fixed behavior information and flexible behavior information, and the arbitration unit arbitrating the first behavior information and the second behavior information comprises: arbitrating, by the arbitration unit, the fixed behavior information comprised in the first behavior information and the fixed behavior information comprised in the second behavior information; arbitrating, by the arbitration unit, the flexible behavior information comprised in the first behavior information and the flexible behavior information comprised in the second behavior information.

[0081] Optionally, the arbitration unit comprises a fixed arbitration module and a configurable arbitration module, the arbitration unit arbitrating the fixed behavior information comprised in the first behavior information and the fixed behavior information comprised in the second behavior information comprises: arbitrating, by the fixed arbitration module, the fixed behavior information comprised in the first behavior information and the fixed behavior information comprised in the second behavior information; and the arbitration unit arbitrating the flexible behavior information comprised in the first behavior information and the flexible behavior information comprised in the second behavior information comprises: arbitrating, by the configurable arbitration module, the flexible behavior information comprised in the first behavior information and the flexible behavior information comprised in the second behavior information.

[0082] Optionally, the ACL processing apparatus further comprises a decoding unit, and the method further comprises: normalizing, by the decoding unit, the first behavior information and the second behavior information; and correspondingly, the arbitration unit arbitrating the first behavior information and the second behavior information comprises: arbitrating, by the arbitration unit, the normalized first behavior information and the normalized second behavior information.

[0083] Optionally, the decoding unit comprises a first decoding module and a second decoding module; the decoding unit normalizes the first behavior information and the second behavior information, comprising: the first decoding module normalizes the first behavior information; the second decoding module normalizes the second behavior information.

[0084] Optionally, the first behavior information comprises fixed behavior information and flexible behavior information, and the first decoding module comprises a fixed decoding submodule and a configurable decoding submodule; the first decoding module normalizes the first behavior information, comprising: the fixed decoding submodule normalizes the fixed behavior information comprised in the first behavior information; the configurable decoding submodule normalizes the flexible behavior information comprised in the first behavior information.

[0085] Optionally, the second behavior information comprises fixed behavior information and flexible behavior information, and the second decoding module comprises a fixed decoding submodule and a configurable decoding submodule; the second decoding module normalizes the second behavior information, comprising: the fixed decoding submodule normalizes the fixed behavior information comprised in the second behavior information; the configurable decoding submodule normalizes the flexible behavior information comprised in the second behavior information.

[0086] Optionally, the constructing unit comprises a first constructing module and a second constructing module; the constructing unit constructs the first key information according to the basic information set, comprising: the first constructing module constructs the first key information according to the basic information set; the constructing unit constructs the second key information according to the basic information set, comprising: the second constructing module constructs the second key information according to the basic information set.

[0087] Optionally, the constructing unit constructs the first key information according to the basic information set, comprising: the constructing unit constructs a plurality of key information according to the basic information set, the plurality of key information comprising the first key information; the searching unit searches the ACL rule library according to the first key information, comprising: the searching unit searches the ACL rule library according to the plurality of key information, to obtain a plurality of target behavior information corresponding to the plurality of key information, the plurality of target behavior information comprising the first behavior information and the second behavior information; the arbitrating unit arbitrates the first behavior information and the second behavior information, comprising: the arbitrating unit arbitrates the plurality of target behavior information.

[0088] Optionally, the constructing unit comprises a plurality of constructing modules; the constructing unit constructs a plurality of key information according to the basic information set, comprising: the plurality of constructing modules construct the plurality of key information according to the basic information set, the plurality of key information corresponding to the plurality of constructing modules.

[0089] Optionally, the arbitration unit comprises a fixed arbitration module and a configurable arbitration module, at least two of the plurality of target behavior information comprises fixed behavior information and flexible behavior information; the arbitration unit arbitrates the plurality of target behavior information, comprising: the fixed arbitration module arbitrates the fixed behavior information included in the plurality of target behavior information; the configurable arbitration module arbitrates the flexible behavior information included in the plurality of target behavior information.

[0090] Optionally, the ACL processing apparatus further comprises a decoding unit; the method further comprises: the decoding unit normalizes the plurality of target behavior information; correspondingly, the arbitration unit arbitrates the plurality of target behavior information, comprising: the arbitration unit arbitrates the normalized plurality of target behavior information.

[0091] Optionally, the decoding unit comprises a plurality of decoding modules, the plurality of decoding modules correspond one-to-one to the plurality of construction modules; the decoding unit normalizes the plurality of target behavior information, comprising: the plurality of decoding modules correspond one-to-one to normalize the plurality of target behavior information.

[0092] Optionally, the arbitration unit arbitrates the first behavior information and the second behavior information to obtain arbitration behavior information, the ACL processing apparatus further comprises an execution unit, and the method further comprises: the execution unit executes the operation behavior indicated by the arbitration behavior information for the first packet.

[0093] Optionally, the first fixed extraction module comprises an ASIC.

[0094] Optionally, the first packet information comprises one or more of the following: packet header information of the first packet, forwarding information of the first packet.

[0095] In a fourth aspect, a forwarding chip is provided, comprising the ACL processing apparatus provided in the first aspect or any optional implementation manner of the first aspect. The forwarding chip comprises a programmable logic circuit and / or program instructions, and when the forwarding chip is running, is used to implement at least part of the steps of the method provided in the second aspect or any optional implementation manner of the second aspect; or, implement at least part of the steps of the method provided in the third aspect or any optional implementation manner of the third aspect.

[0096] Optionally, the architecture of the forwarding chip is a run to completion (RTC) architecture or a pipeline architecture.

[0097] Optionally, the architecture of the forwarding chip is an RTC architecture, the forwarding chip comprises a processor core and a ternary content-addressable memory (TCAM) array, the processor core comprises the obtaining unit in the ACL processing apparatus, and the TCAM array comprises the constructing unit and the lookup unit in the ACL processing apparatus.

[0098] Optionally, the architecture of the forwarding chip is a pipeline architecture, and the forwarding chip comprises a plurality of processing nodes, at least one of the plurality of processing nodes comprising the ACL processing apparatus.

[0099] Optionally, the forwarding chip is a network processor (NP) chip. For example, the forwarding chip is a network processor chip of a pipeline architecture or a network processor chip of an RTC architecture.

[0100] In a fifth aspect, a network device is provided, comprising the forwarding chip provided in the third aspect or any of the optional manners of the third aspect.

[0101] In a sixth aspect, a computer readable storage medium is provided, the computer readable storage medium storing a computer program, the computer program being executed to implement at least part of the steps of the method provided in the second aspect or any of the optional manners of the second aspect, or to implement at least part of the steps of the method provided in the third aspect or any of the optional manners of the third aspect.

[0102] In a seventh aspect, a computer program product is provided, the computer program product comprising a program or code, the program or code being executed to implement at least part of the steps of the method provided in the second aspect or any of the optional manners of the second aspect, or to implement at least part of the steps of the method provided in the third aspect or any of the optional manners of the third aspect.

[0103] The technical effects of the second aspect to the seventh aspect can refer to the first aspect, and thus will not be described in detail. BRIEF DESCRIPTION OF DRAWINGS

[0104] Figure 1 is a schematic diagram of an ACL processing apparatus provided by an embodiment of the present application;

[0105] Figure 2 is a schematic diagram of another ACL processing apparatus provided by an embodiment of the present application;

[0106] Figure 3 is a schematic diagram of still another ACL processing apparatus provided by an embodiment of the present application;

[0107] Figure 4is a schematic diagram of another ACL processing device provided by an embodiment of the present application;

[0108] Figure 5 is a schematic diagram of normalizing behavior information provided by an embodiment of the present application;

[0109] Figure 6 is a schematic diagram of another ACL processing device provided by an embodiment of the present application;

[0110] Figure 7 is a schematic diagram of another ACL processing device provided by an embodiment of the present application;

[0111] Figure 8 is a schematic diagram of another ACL processing device provided by an embodiment of the present application;

[0112] Figure 9 is a flowchart of an ACL processing method provided by an embodiment of the present application;

[0113] Figure 10 is a flowchart of obtaining a basic information set provided by an embodiment of the present application;

[0114] Figure 11 is a schematic diagram of a forwarding chip provided by an embodiment of the present application;

[0115] Figure 12 is a schematic diagram of another forwarding chip provided by an embodiment of the present application;

[0116] Figure 13 is a schematic diagram of a network device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0117] The embodiments of the present application will be further described in detail below with reference to the drawings.

[0118] The forwarding chip in the network device usually includes an access control list (ACL) processing apparatus, which is used to process a packet according to an ACL rule library to perform packet filtering, packet redirection, traffic statistics, priority mapping, traffic monitoring, rate limiting, and the like. The ACL rule library is a set of a series of ACL rules, and is also referred to as an ACL rule set. Each ACL rule in the ACL rule library is composed of a positive (permit) statement or a negative (deny) statement, and each ACL rule includes a match item and an action item. The match item includes match information, which is used by the ACL processing apparatus to match the ACL rule according to packet information. The action item includes action information, which is used by the ACL processing apparatus to process a packet matched with the ACL rule. For example, the ACL processing apparatus includes a construction unit, a lookup unit, and an execution unit. In the process of forwarding any packet, the construction unit constructs key information according to packet information of the any packet; the lookup unit matches the key information with a match item (specifically, with match information included in the match item) in the ACL rule library to determine a match item matched with the key information, and further determine an ACL rule matched with the key information; and the execution unit processes the packet according to an action item (specifically, according to action information included in the action item) of the ACL rule. According to different operation behaviors indicated by the action item, the execution unit can implement filtering of the any packet, packet redirection, traffic statistics, priority mapping, traffic monitoring, rate limiting, and the like.

[0119] With the diversified development of network services, the complexity of network services is increasingly high, and users continuously propose more refined and customized operations for service flows, which requires the continuous improvement of the capability of the ACL processing apparatus to adapt to the development of network services. The capability of the ACL processing apparatus mainly reflects in the construction of key information and the execution of operation behaviors, and the like. For example, the increase in the types and quantity of key information requires the improvement of the capability of the ACL processing apparatus, and the increase and complexity of operation behaviors also require the improvement of the capability of the ACL processing apparatus.

[0120] Currently, there are two types of ACL processing devices in the industry, namely fixed ACL processing devices and configurable ACL processing devices. The fixed ACL processing device is highly hardened and can usually only implement fixed functions, such as constructing fixed key information and performing fixed operation behaviors. The fixed ACL processing device has a small resource overhead and a good performance, and is often applied to an application specific integrated circuit (ASIC) forwarding chip. The fixed ACL processing device is also called a hardened ACL processing device, a solidified ACL processing device, or an ASIC ACL processing device. The configurable ACL processing device is highly configurable, and its capabilities can be flexibly changed by configuring the configurable ACL processing device. For example, in the configurable ACL processing device, the construction of key information and the execution of operation behaviors can be implemented by programming. The configurable ACL processing device is suitable for various business scenarios and has good expansion capability, and is often applied to a run to completion (RTC) architecture forwarding chip and a pipeline architecture forwarding chip.

[0121] However, the flexibility and expansion capability of the current fixed ACL processing device are both low, and even the fixed ACL processing device has no expansion capability (the functions of the fixed ACL processing device have been solidified and cannot be modified). The current configurable ACL processing device has a large resource overhead, which leads to a low realizability. For example, in the RTC architecture, the ACL processing device implements ACL processing functions (such as construction of key information and execution of operation behaviors) by executing ACL-related operation instructions (hereinafter referred to as ACL operation instructions), which requires the ACL processing device or the forwarding chip including the ACL processing device to have sufficient instruction space to store the ACL operation instructions. However, as the number and types of key information increase, the ACL operation instructions also increase, which requires the instruction space for storing the ACL operation instructions to increase. This not only leads to an increase in the instruction space of the forwarding chip, but also leads to the ACL operation instructions occupying the instruction space of the core business, and further affects the forwarding delay and forwarding bandwidth of the business flow. For another example, in the pipeline architecture, the ACL processing device relies on programmable circuits to implement ACL processing functions. The diversification of network services complicates the functions of the ACL processing device, the programmable circuits of the ACL processing device, and the hardware overhead of the programmable circuits of the ACL processing device, which leads to an increase in the area and functions of the forwarding chip, a reduction in the realizability, and a poor performance power area (PPA) of the forwarding chip.

[0122] The embodiment of the present application provides an ACL processing device and method, a forwarding chip and a network device. The ACL processing device comprises a fixed structure and a configurable structure. The function of the fixed structure is fixed, and the function of the configurable structure is configurable. For example, the fixed structure is used to realize some stable ACL functions (or mature ACL functions), and the configurable structure can be used to realize some unstable ACL functions (or immature ACL functions). In this way, on the one hand, the resource overhead of the ACL processing device can be reduced; on the other hand, the flexibility and expansion capability of the ACL processing device can be improved. In an example, the ACL processing device comprises an acquisition unit, a construction unit and a lookup unit. The acquisition unit is used to acquire a basic information set according to first message information. The construction unit is used to construct first key information according to the basic information set. The lookup unit is used to look up an ACL rule library according to the first key information. The acquisition unit is further used to extract fixed information of a first protocol layer from the first message information, and extract flexible information from the first message information according to user configuration information (since the acquisition unit can extract any information in the first message information according to the user configuration information, the information extracted from the first message information by the acquisition unit according to the user configuration information is referred to as flexible information). The basic information in the basic information set comprises the fixed information and the flexible information. Since the acquisition unit comprises a configurable extraction function, the flexibility and expansion capability of the acquisition unit are high, and the flexibility and expansion capability of the ACL processing device are high. Since the acquisition unit comprises a fixed extraction function, the resource overhead of the acquisition unit is small, and the resource overhead of the ACL processing device is small. In an example, the acquisition unit comprises a configurable extraction module and a first fixed extraction module. The first fixed extraction module is used to extract fixed information of a first protocol layer from first message information, and the configurable extraction module is used to extract flexible information from the first message information according to user configuration information. In this way, the acquisition unit of the present application can optionally comprise a fixed extraction module and a configurable extraction module. When the acquisition unit acquires the basic information set, the fixed extraction module extracts fixed information of a protocol layer, and the configurable extraction module extracts flexible information according to user configuration information. In this way, on the one hand, the resource overhead of the acquisition unit can be reduced, thereby reducing the resource overhead of the ACL processing device; on the other hand, the flexibility and expansion capability of the acquisition unit can be improved, thereby improving the flexibility and expansion capability of the ACL processing device.

[0123] The technical scheme of the present application is introduced below. First, the embodiment of the ACL processing device of the present application is introduced.

[0124] Figure 1This is a schematic diagram of an ACL processing device provided in an embodiment of this application. The ACL processing device is applied to a forwarding chip, which can be a run-to-completion (RTC) architecture forwarding chip or a pipeline architecture forwarding chip, such as a pipeline architecture network processor chip. Figure 1 As shown, the ACL processing device includes an acquisition unit 10, a construction unit 20, and a search unit 30, which are connected sequentially. The acquisition unit 10 is used to acquire a basic information set based on first message information, where the first message information is information related to the first message, and the basic information set includes at least one basic piece of information related to the first message. The construction unit 20 is used to construct first key information based on the basic information set, where the first key information includes at least one piece of basic information from the basic information set. The search unit 30 is used to search the ACL rule base based on the first key information. The acquisition unit 10 is also used to extract fixed information from the first protocol layer of the first message information, and to extract flexible information from the first message information based on user configuration information. The basic information in the basic information set includes both the fixed information and the flexible information.

[0125] The basic information set can be composed of multiple basic information extracted by the acquisition unit 10 from the first message information. These multiple basic information may include flexible information and fixed information of the first protocol layer. The acquisition unit 10 can obtain the basic information set based on the multiple basic information extracted from the first message information and output the basic information set.

[0126] The first key information includes at least one piece of basic information from the basic information set, and includes at least one fixed piece of information and / or at least one flexible piece of information from the basic information set. For example, the first key information is composed of at least one piece of basic information from the basic information set. For instance, the first key information includes at least one information field, and each of the at least one information field includes one piece of basic information from the basic information set. The construction unit 20 can construct the first key information based on at least one piece of basic information from the basic information set; for example, if the at least one piece of basic information is multiple pieces of basic information, the construction unit 20 can combine these multiple pieces of basic information to obtain the first key information.

[0127] The first behavior information is obtained by the searching unit 30 searching the ACL rule library according to the first key information. The first behavior information is included in the ACL rule library, and the first key information matches the ACL rule library. For example, the ACL rule library includes a plurality of ACL rules, and the first key information matches at least one of the ACL rules in the ACL rule library. For example, the plurality of ACL rules respectively include a matching item and a behavior item. The matching item includes matching information, and the behavior item includes behavior information. The behavior information is used to indicate an operation behavior. The first key information matches the matching item (i.e., the matching information included in the matching item) of at least one of the ACL rules, and thus matches the at least one of the ACL rules. The first behavior information is the behavior information included in the behavior item of the at least one of the ACL rules. The first behavior information includes at least one behavior information. For example, the first behavior information includes a plurality of behavior information, and the first behavior information is a behavior information set (e.g., a first behavior information set). Optionally, the searching unit 30 is a ternary content-addressable memory (TCAM) searching unit. For example, the searching unit 30 is a TCAM, and the searching result (e.g., the first behavior information) obtained by the searching unit 30 searching the ACL rule library is also referred to as associated data (AD) of the TCAM.

[0128] In some embodiments, the information set constructed by the obtaining unit 10 is referred to as a key information set, and the information in the key information set is referred to as key information. In some other embodiments, the information set constructed by the obtaining unit 10 is referred to as super key information, and each piece of information in the super key information is a piece of information in the super key information. For example, the super key information includes a plurality of information fields, and each information field includes a piece of key information. In the two embodiments, the first key information constructed according to the key information set or the super key information can be referred to as lookup key information.

[0129] In addition, in order to facilitate the distinction, the present application adopts the expressions of "fixed information" and "flexible information". It can be understood that the fixed information and the flexible information are both information included in the first packet information, and the flexible information can also be the same as the fixed information. In some embodiments, the fixed information and the flexible information are both referred to as key information.

[0130] In summary, the ACL processing device provided by the embodiments of the present application has the following advantages. The obtaining unit in the ACL processing device includes fixed extraction function and configurable extraction function, so that the obtaining unit can extract fixed information of the first protocol layer from the first message information, and can extract flexible information from the first message information according to user configuration information. Therefore, the flexibility and expansion capability of the obtaining unit, the ACL processing device and the forwarding chip including the ACL processing device are high. Moreover, the resource consumption of the obtaining unit, the ACL processing device and the forwarding chip including the ACL processing device is low.

[0131] In the embodiments of the present application, the first message information is information obtained (for example, received) by the ACL processing device, the first message information includes any possible information related to the first message, the first message information can be a set of message information related to the first message, and the first message information can include protocol information of at least one protocol layer. For example, the first message information includes one or more of the following: message header information of the first message, forwarding information of the first message.

[0132] The message header information of the first message is information carried by a message header of the first message, including but not limited to information carried by a layer 2 (L2) message header of the first message, information carried by a layer 3 (L3) message header of the first message, information carried by a layer 4 (L4) message header of the first message, and the like. For ease of description, the information carried by the L2 message header is referred to as L2 information, the information carried by the L3 message header is referred to as L3 information, the information carried by the L4 message header is referred to as L4 information, and the like. The L2 information corresponds to an L2 protocol layer, and is protocol information of the L2 protocol layer. The L3 information corresponds to an L3 protocol layer, and is protocol information of the L3 protocol layer. The L4 information corresponds to an L4 protocol layer, and is protocol information of the L4 protocol layer. The like. For example, the L2 information includes media access control (MAC) information, virtual local area network (VLAN) information, L2 tunnel information, L2 priority information, and the like, the MAC information is, for example, a source MAC (SMAC) address and a destination MAC (DMAC) address, the VLAN information is, for example, a VLAN tag, the L2 tunnel information is, for example, virtual extensible local area network (VXLAN) tunnel information of layer 2, and the L2 priority information is, for example, 802.1p priority information, 802.1p is an abbreviation of Institute of Electrical and Electronics Engineers (IEEE) 802.1p, and the 802.1p priority is also referred to as class of service (COS) priority. The L3 information includes internet protocol (IP) information, address resolution protocol (ARP) information, L3 tunnel information, L3 priority information, service requirement information, virtual private network (VPN) information, and the like. The IP information is, for example, a three-tuple, a five-tuple, internet protocol version 4 (IPv4) information, internet protocol version 6 (IPv6) information, and the like.L3 tunnel information, for example, IP tunnel information, IPv6 tunnel information, segment routing (SR) tunnel information, internet protocol version 6 segment routing (SRv6) tunnel information. L3 priority information, for example, differentiated services code point (DSCP) priority information, type of service priority information, etc. Service requirement information, for example, latency requirement information, jitter requirement information, packet loss requirement information, bandwidth requirement information, etc. VPN information, for example, VPN identifier. L4 information includes user datagram protocol (UDP) information, transmission control protocol (TCP) information, internet control message protocol (ICMP) information, etc.

[0133] The forwarding information of the first packet is information related to the first packet obtained by the forwarding chip through any possible way such as table lookup and analysis during the forwarding of the first packet by the forwarding chip. In one example, the forwarding chip is in the first network device, and the forwarding information of the first packet includes information determined by the forwarding chip according to a port (i.e., an ingress port of the first packet) of the first network device receiving the first packet, such as but not limited to a port number of the ingress port, configuration information of the ingress port, associated information of the ingress port, attribute information of the ingress port, etc. In another example, the forwarding information of the first packet includes information of an egress port of the first packet obtained by the forwarding chip through table lookup, such as but not limited to a port number of the egress port, configuration information of the egress port, associated information of the egress port, attribute information of the egress port, etc. In still another example, the forwarding information of the first packet includes packet type information corresponding to the at least one protocol layer obtained by the forwarding chip through analysis of a packet header of the first packet, such as a L2 type corresponding to a L2 protocol layer of the first packet, a L3 type corresponding to a L3 protocol layer of the first packet, a L4 type corresponding to a L4 protocol layer of the first packet, and so on. The L2 type includes a MAC type, a VLAN type, etc. The L3 type includes an IPv4 type, an IPv6 type, an ARP type, etc. The L4 type includes a UDP type, a TCP type, an ICMP type, etc. The forwarding information of the first packet includes L2 type information, L3 type information, L4 type information, etc. The L2 type information is used to indicate the packet type (i.e., the L2 type) of the first packet corresponding to the L2 protocol layer, and specifically, the L2 type information includes MAC type information, VLAN type information, etc.; the MAC type information is used to indicate that the packet type of the first packet is the MAC type (i.e., the first packet is a MAC packet); and the VLAN type information is used to indicate that the packet type of the first packet is the VLAN type (i.e., the first packet is a VLAN packet). The L3 type information is used to indicate the packet type (i.e., the L3 type) of the first packet corresponding to the L3 protocol layer, and specifically, the L3 type information includes IPv4 type information, IPv6 type information, ARP type information, etc.; the IPv4 type information is used to indicate that the packet type of the first packet is the IPv4 type (i.e., the first packet is an IPv4 packet); the IPv6 type information is used to indicate that the packet type of the first packet is the IPv6 type (i.e., the first packet is an IPv6 packet); and the ARP type information is used to indicate that the packet type of the first packet is the ARP type (i.e., the first packet is an ARP packet).The L4 type information is used to indicate a message type (i.e., L4 type) of the first message corresponding to the L4 protocol layer, and specifically, the L4 type information includes UDP type information, TCP type information, ICMP type information, etc. The UDP type information is used to indicate that the message type of the first message is a UDP type (i.e., the first message is a UDP message). The TCP type information is used to indicate that the message type of the first message is a TCP type (i.e., the first message is a TCP message). The ICMP type information is used to indicate that the message type of the first message is an ICMP type (i.e., the first message is an ICMP message). Here, only the forwarding information of the first message is exemplarily described, and the forwarding information of the first message can be any possible forwarding information related to the first message, which is also referred to as context forwarding information or forwarding metadata, etc., which is not limited in the present application.

[0134] Figure 2 is a schematic diagram of another ACL processing apparatus provided by the embodiments of the present application. As shown in Figure 2 the ACL processing apparatus includes an obtaining unit 10, a constructing unit 20 and a searching unit 30. The obtaining unit 10 includes a configurable extraction module 101 and a first fixed extraction module 102. The first fixed extraction module 102 is fixed to correspond to a first protocol layer, and is used to extract fixed information of the first protocol layer from first message information. The configurable extraction module 101 is used to extract flexible information from the first message information according to user configuration information. The first fixed extraction module 102 outputs the fixed information of the first protocol layer after extracting the fixed information, and the configurable extraction module 101 outputs the flexible information after extracting the flexible information. For example, the obtaining unit 10 is connected to the constructing unit 20 through a first data bus, the first fixed extraction module 102 outputs the fixed information of the first protocol layer to a first fixed position of the first data bus (or said the first fixed extraction module 102 outputs the fixed information of the first protocol layer through the first fixed position), and the configurable extraction module 101 outputs the flexible information to any flexible position of the first data bus (or said the configurable extraction module 101 outputs the flexible information through the any flexible position). For example, the first data bus includes a plurality of data lines, and the first data bus includes a fixed part and a flexible part. The fixed part and the flexible part respectively include at least one data line in the first data bus, the data lines included in the fixed part do not overlap with the data lines included in the flexible part, the first fixed position includes at least one data line of the fixed part, the first fixed extraction module 102 outputs the fixed information of the first protocol layer through the at least one data line, and the configurable extraction module 101 outputs the flexible information extracted by the configurable extraction module 101 through any at least one data line of the flexible part.

[0135] In an optional embodiment, the obtaining unit 10 is further configured to extract the fixed information of the second protocol layer from the first message information, and the basic information in the basic information set further comprises the fixed information of the second protocol layer. Figure 3 is a schematic diagram of another ACL processing device provided by the embodiment of the present application. Figure 2 is a schematic diagram of the ACL processing device shown in Figure 3 In the ACL processing device shown in Figure 3 , the obtaining unit 10 further comprises a second fixed extraction module 103. The second fixed extraction module 103 is fixed to correspond to the second protocol layer, and the second protocol layer is different from the first protocol layer. For example, the first protocol layer is the L3 protocol layer, and the second protocol layer is the L4 protocol layer. The second fixed extraction module 103 is configured to extract the fixed information of the second protocol layer from the first message information. The second fixed extraction module 103 outputs the fixed information of the second protocol layer after extracting the fixed information of the second protocol layer. For example, the obtaining unit 10 and the constructing unit 20 are connected through a first data bus, and the second fixed extraction module 103 outputs the fixed information of the second protocol layer of the second protocol layer to a second fixed position of the first data bus (or the second fixed extraction module 103 outputs the fixed information of the second protocol layer through the second fixed position). For example, the second fixed position comprises at least one data line of a fixed part of the first data bus, and the second fixed extraction module 103 outputs the fixed information of the second protocol layer through the at least one data line.

[0136] In an optional embodiment, the obtaining unit 10 is further configured to extract target information of a first message type from the first message information, the first message type belongs to the first protocol layer; determine the fixed information of the first protocol layer according to the first type information and the target information of the first message type, the first type information is used to indicate the message type of the first message corresponding to the first protocol layer. In addition, the obtaining unit 10 is further configured to extract target information of a second message type from the first message information, the second message type belongs to the second protocol layer; determine the fixed information of the second protocol layer according to the second type information and the target information of the second message type, the second type information is used to indicate the message type of the first message corresponding to the second protocol layer. For example, in the embodiment in which the obtaining unit 10 comprises the first fixed extraction module 102, the first fixed extraction module 102 is further configured to extract the target information of the first message type from the first message information, and determine the fixed information of the first protocol layer according to the first type information and the target information of the first message type. In the embodiment in which the obtaining unit 10 comprises the second fixed extraction module 103, the second fixed extraction module 103 is further configured to extract the target information of the second message type from the first message information, and determine the fixed information of the second protocol layer according to the second type information and the target information of the second message type.

[0137] Figure 4Figure 1 is a schematic diagram of another ACL processing device provided by an embodiment of the present application, which comprises an obtaining unit 10, a constructing unit 20 and a searching unit 30. The obtaining unit 10 comprises a configurable extraction module 101, a first fixed extraction module 102 and a second fixed extraction module 103. Figure 4 As shown in Figure 1, the first fixed extraction module 102 comprises a first selection sub-module 1021 and at least one first fixed extraction sub-module connected to the first selection sub-module 1021. Figure 2 Taking an example of the at least one first fixed extraction sub-module being n first fixed extraction sub-modules, n is a positive integer. The at least one first fixed extraction sub-module corresponds to at least one first packet type one by one, and the at least one first packet type belongs to a first protocol layer. Each first fixed extraction sub-module in the at least one first fixed extraction sub-module is configured to extract target information of the first packet type corresponding to the each first fixed extraction sub-module from the first packet information. The first selection sub-module 1021 is configured to determine fixed information of the first protocol layer according to the first type information and the target information extracted from the first packet information by the at least one first fixed extraction sub-module, and the first packet information comprises the first type information, which is configured to indicate the packet type of the first packet corresponding to the first protocol layer. For example, the first protocol layer is an L3 protocol layer, the at least one first fixed extraction sub-module comprises a first fixed extraction sub-module (e.g., first fixed extraction sub-module 1) corresponding to an IPv4 type, a first fixed extraction sub-module (e.g., first fixed extraction sub-module 2) corresponding to an IPv6 type and a first fixed extraction sub-module (e.g., first fixed extraction sub-module 3) corresponding to an ARP type, the first fixed extraction sub-module 1 extracts IPv4 information (i.e., target information of the IPv4 type) from the first packet information, the first fixed extraction sub-module 2 extracts IPv6 information (i.e., target information of the IPv6 type) from the first packet information, and the first fixed extraction sub-module 3 extracts ARP information (i.e., target information of the ARP type) from the first packet information. Assuming that the first type information is IPv6 type information, the first type information is configured to indicate that the first packet is an IPv6 packet, and the first selection sub-module 1021 determines the fixed information of the first protocol layer to be IPv6 information according to the first type information and the target information extracted from the first packet information by the first fixed extraction sub-module 1, the first fixed extraction sub-module 2 and the first fixed extraction sub-module 3. That is, the first selection sub-module 1021 determines the IPv6 information extracted from the first packet information by the first fixed extraction sub-module 2 as the fixed information of the first protocol layer.

[0138] As shown in Figure 1, the first fixed extraction module 102 comprises a first selection sub-module 1021 and at least one first fixed extraction sub-module connected to the first selection sub-module 1021. Figure 4As shown, the second fixed extraction module 103 includes a second selection submodule 1031 and at least one second fixed extraction submodule, which is connected to the second selection submodule 1031. Figure 4 Taking the example of at least n second fixed extraction submodules, where n is a positive integer, as an example, each of these at least n second fixed extraction submodules corresponds to at least one second message type, which belongs to the second protocol layer. Each of these at least n second fixed extraction submodules is used to extract target information of the second message type corresponding to each second fixed extraction submodule from the first message information. The second selection submodule 1031 is used to determine the fixed information of the second protocol layer based on the second type information and the target information extracted from the first message information by the at least n second fixed extraction submodules. The first message information includes the second type information, which indicates the message type of the first message corresponding to the second protocol layer. For example, the second protocol layer is the L4 protocol layer. The at least one second fixed extraction submodule includes a second fixed extraction submodule corresponding to UDP type (e.g., second fixed extraction submodule 1), a second fixed extraction submodule corresponding to TCP type (e.g., second fixed extraction submodule 2), and a second fixed extraction submodule corresponding to ICMP type (e.g., second fixed extraction submodule 3). Second fixed extraction submodule 1 extracts UDP information (i.e., UDP-type target information) from the first message information; second fixed extraction submodule 2 extracts TCP information (i.e., TCP-type target information) from the first message information; and second fixed extraction submodule 3 extracts ICMP information (i.e., ICMP-type target information) from the first message information. Assuming the second type information is UDP-type information, used to indicate that the first message is a UDP message, the second selection submodule 1031 determines that the fixed information of the second protocol layer is UDP information based on the second type information and the target information extracted from the first message information by the three second fixed extraction submodules (second fixed extraction submodule 1, second fixed extraction submodule 2, and second fixed extraction submodule 3). That is, the second selection submodule 1031 determines the UDP information extracted from the first message information by the second fixed extraction submodule 1 as the fixed information of the second protocol layer.

[0139] like Figure 4 As shown, the configurable extraction module 101 includes multiple configurable extraction sub-modules. Figure 4The configurable extraction sub-modules are taken as an example, and m is an integer greater than 1. Bit widths of at least two configurable extraction sub-modules in the plurality of configurable extraction sub-modules are different. Each configurable extraction sub-module in the plurality of configurable extraction sub-modules is configured to extract flexible information from the first message information according to user configuration information and a bit width of the each configurable extraction sub-module, and the basic information set includes the flexible information extracted from the first message information by the plurality of configurable extraction sub-modules. For example, the plurality of configurable extraction sub-modules include configurable extraction sub-modules with a bit width of a word, configurable extraction sub-modules with a bit width of a half word, configurable extraction sub-modules with a bit width of a byte, and configurable extraction sub-modules with a bit width of a nibble, and the number of configurable extraction sub-modules with each bit width is one or more. The configurable extraction sub-modules with the bit width of the word extract the flexible information from the first message information according to the width of the word. The configurable extraction sub-modules with the bit width of the half word extract the flexible information from the first message information according to the width of the half word. The configurable extraction sub-modules with the bit width of the byte extract the flexible information from the first message information according to the width of the byte. The configurable extraction sub-modules with the bit width of the nibble extract the flexible information from the first message information according to the width of the nibble. For example, the bit width of the configurable extraction sub-module 1 is a word, the bit width of the configurable extraction sub-module 2 is a half word, the bit width of the configurable extraction sub-module 3 is a byte, and the bit width of the configurable extraction sub-module 4 is a nibble. After each configurable extraction sub-module in the plurality of configurable extraction sub-modules extracts the flexible information from the first message information, the each configurable extraction sub-module can output the flexible information to any flexible position of the first data bus.

[0140] In an optional embodiment, the constructing unit 20 is further configured to construct second key information according to the basic information set. The searching unit 30 is further configured to search the ACL rule library according to the second key information. The second key information includes at least one of the basic information in the basic information set, and the second key information includes at least one of the fixed information and / or at least one of the flexible information in the basic information set. The second key information is different from the first key information, or the second key information is at least partially the same as the first key information, for example, the second key information and the first key information respectively include at least one information field, and the at least one information field of the second key information includes the same basic information as the at least one information field of the first key information. The searching unit 30 searches the ACL rule library according to the second key information to obtain second behavior information, and the second behavior information is included in the ACL rule library, and the second key information matches the ACL rule library. For example, the second key information matches at least one ACL rule in the ACL rule library, so that the second key information matches the ACL rule library. For example, the second key information matches the matching item (i.e., the matching information included in the matching item) of at least one ACL rule in the ACL rule library, so that the second key information matches the at least one ACL rule. The second behavior information is the behavior information included in the behavior item of the at least one ACL rule, and the second behavior information can include at least one behavior information, for example, the second behavior information includes a plurality of behavior information, and the second behavior information can be a behavior information set (e.g., a second behavior information set).

[0141] As shown in Figure 4 , the constructing unit 20 includes a first constructing module 201 and a second constructing module 202, and the searching unit 30 includes a first searching module 301 and a second searching module 302. The acquisition unit 10, the first constructing module 201, and the first searching module 301 are sequentially connected, and the acquisition unit 10, the second constructing module 202, and the second searching module 302 are sequentially connected. The first constructing module 201 is configured to construct first key information according to the basic information set, and the first searching module 301 is configured to search the ACL rule library according to the first key information. The second constructing module 202 is configured to construct second key information according to the basic information set, and the second searching module 302 is configured to search the ACL rule library according to the second key information. The searching unit 30 (specifically, the first searching module 301) searches the ACL rule library according to the first key information to obtain first behavior information, and the searching unit 30 (specifically, the second searching module 302) searches the ACL rule library according to the second key information to obtain second behavior information. Please refer to Figure 3 and Figure 4The ACL processing apparatus further comprises an arbitration unit 40 connected with the lookup unit 30, for example, the arbitration unit 40 is connected with the first lookup module 301 and the second lookup module 302 respectively. The arbitration unit 40 is configured to arbitrate the first behavior information and the second behavior information. For example, the first behavior information and the second behavior information each comprises a plurality of behavior information, and the arbitration unit 40 is configured to de-duplicate and merge the first behavior information and the second behavior information to arbitrate. The arbitration unit 40 can obtain arbitration behavior information by arbitrating the first behavior information and the second behavior information, and the arbitration behavior information can be a union set of the first behavior information and the second behavior information. The arbitration unit 40 can output the arbitration behavior information through an output interface of the arbitration unit 40.

[0142] Optionally, the first behavior information and the second behavior information each comprises fixed behavior information and flexible behavior information, the fixed behavior information is behavior information fixed in the ACL rule library, and the flexible behavior information is behavior information configurable by the ACL rule library. The arbitration unit 40 is configured to arbitrate the fixed behavior information included in the first behavior information and the fixed behavior information included in the second behavior information, and arbitrate the flexible behavior information included in the first behavior information and the flexible behavior information included in the second behavior information. For example, as shown in Figure 4 the arbitration unit 40 comprises a fixed arbitration module 401 and a configurable arbitration module 402, the fixed arbitration module 401 is configured to arbitrate the fixed behavior information included in the first behavior information and the fixed behavior information included in the second behavior information, and the configurable arbitration module 402 is configured to arbitrate the flexible behavior information included in the first behavior information and the flexible behavior information included in the second behavior information. For example, the fixed arbitration module 401 de-duplicates and merges the fixed behavior information included in the first behavior information and the fixed behavior information included in the second behavior information to obtain arbitration fixed behavior information, and the fixed arbitration module 401 outputs the arbitration fixed behavior information through a fixed part of an output interface of the arbitration unit 40. The configurable arbitration module 402 de-duplicates and merges the flexible behavior information included in the first behavior information and the flexible behavior information included in the second behavior information to obtain arbitration flexible behavior information, and the configurable arbitration module 402 outputs the arbitration flexible behavior information through a flexible part of the output interface of the arbitration unit 40.

[0143] In optional embodiments, please continue to refer to Figure 3 and Figure 4The ACL processing device also includes a decoding unit 50, which is connected between the lookup unit 30 and the arbitration unit 40. Specifically, the decoding unit 50 is connected to the output of the lookup unit 30 and the input of the arbitration unit 40. For example, the decoding unit 50 is connected to the lookup unit 30 via a second data bus, and to the arbitration unit 40 via a third data bus. The decoding unit 50 is used to normalize the first line information and the second line information. The decoding unit 50 obtains normalized first line information from the first line information, and it also normalizes the second line information to obtain normalized second line information. The arbitration unit 40 is used to arbitrate the normalized first line information and the normalized second line information. The normalization of the first line information and the second line information by the decoding unit 50 can also be referred to as decoding or parsing the first line information and the second line information. Normalization ensures that the first line information and the second line information have the same format, facilitating arbitration by the arbitration unit 40. Optionally, the decoding unit 50 outputs normalized first line information and normalized second line information to the third data bus (or the decoding unit 50 outputs normalized first line information and normalized second line information through the third data bus), and the arbitration unit 40 obtains the normalized first line information and normalized second line information from the third data bus.

[0144] like Figure 4 As shown, the decoding unit 50 includes a first decoding module 501 and a second decoding module 502. The first decoding module 501 is connected to the first lookup module 301, and the second decoding module 502 is connected to the second lookup module 302. The first decoding module 501 is used to normalize the first behavioral information. The second decoding module 502 is used to normalize the second behavioral information. Optionally, the first behavioral information includes fixed behavioral information and flexible behavioral information. The first decoding module 501 is used to normalize the fixed behavioral information included in the first behavioral information, and to normalize the flexible behavioral information included in the first behavioral information.

[0145] For example, the first decoding module 501 includes a fixed decoding submodule 5011 and a configurable decoding submodule 5012, the fixed decoding submodule 5011 and the configurable decoding submodule 5012 are connected with the first lookup module 301 respectively, the fixed decoding submodule 5011 is configured to normalize the fixed behavior information included in the first behavior information, and the configurable decoding submodule 5012 is configured to normalize the flexible behavior information included in the first behavior information. The fixed decoding submodule 5011 normalizes the fixed behavior information included in the first behavior information to obtain normalized fixed behavior information, and outputs the normalized fixed behavior information to a fixed position of the third data bus. The configurable decoding submodule 5012 normalizes the flexible behavior information included in the first behavior information to obtain normalized flexible behavior information, and outputs the normalized flexible behavior information to an arbitrary position of the third data bus. Optionally, the second behavior information includes fixed behavior information and flexible behavior information, the second decoding module 502 is configured to normalize the fixed behavior information included in the second behavior information, and normalize the fixed behavior information included in the second behavior information. For example, the second decoding module 502 includes a fixed decoding submodule 5021 and a configurable decoding submodule 5022, the fixed decoding submodule 5021 and the configurable decoding submodule 5022 are connected with the second lookup module 302 respectively, the fixed decoding submodule 5021 is configured to normalize the fixed behavior information included in the second behavior information, and the configurable decoding submodule 5022 is configured to normalize the flexible behavior information included in the second behavior information. The fixed decoding submodule 5021 normalizes the fixed behavior information included in the second behavior information to obtain normalized fixed behavior information, and can output the normalized fixed behavior information to a fixed position of the third data bus. The configurable decoding submodule 5022 normalizes the flexible behavior information included in the second behavior information to obtain normalized flexible behavior information, and can output the normalized flexible behavior information to an arbitrary position of the third data bus.

[0146] For ease of description, the fixed behavior information included in the first behavior information is referred to as first fixed behavior information, and the flexible behavior information included in the first behavior information is referred to as first flexible behavior information. Optionally, the first fixed behavior information includes a plurality of behavior information H-A, and the fixed decoding submodule 5011 includes a plurality of fixed decoders which correspond one-to-one to normalize the plurality of behavior information H-A. The first flexible behavior information includes a plurality of behavior information F-A, and the configurable decoding submodule 5012 includes a plurality of configurable decoders which correspond one-to-one to normalize the plurality of behavior information F-A. For example, Figure 5 is a schematic diagram of the first decoding module 501 normalizing the first behavior information. As shown in FIG. 5, the first decoding module 501 includes a fixed decoding submodule 5011 and a configurable decoding submodule 5012, the fixed decoding submodule 5011 and the configurable decoding submodule 5012 are connected with the first lookup module 301 respectively, the fixed decoding submodule 5011 is configured to normalize the fixed behavior information included in the first behavior information, and the configurable decoding submodule 5012 is configured to normalize the flexible behavior information included in the first behavior information. The fixed decoding submodule 5011 normalizes the fixed behavior information included in the first behavior information to obtain normalized fixed behavior information, and outputs the normalized fixed behavior information to a fixed position of the third data bus. The configurable decoding submodule 5012 normalizes the flexible behavior information included in the first behavior information to obtain normalized flexible behavior information, and outputs the normalized flexible behavior information to an arbitrary position of the third data bus. Optionally, the second behavior information includes fixed behavior information and flexible behavior information, the second decoding module 502 is configured to normalize the fixed behavior information included in the second behavior information, and normalize the fixed behavior information included in the second behavior information. For example, the second decoding module 502 includes a fixed decoding submodule 5021 and a configurable decoding submodule 5022, the fixed decoding submodule 5021 and the configurable decoding submodule 5022 are connected with the second lookup module 302 respectively, the fixed decoding submodule 5021 is configured to normalize the fixed behavior information included in the second behavior information, and the configurable decoding submodule 5022 is configured to normalize the flexible behavior information included in the second behavior information. The fixed decoding submodule 5021 normalizes the fixed behavior information included in the second behavior information to obtain normalized fixed behavior information, and can output the normalized fixed behavior information to a fixed position of the third data bus. The configurable decoding submodule 5022 normalizes the flexible behavior information included in the second behavior information to obtain normalized flexible behavior information, and can output the normalized flexible behavior information to an arbitrary position of the third data bus.Figure 5 As shown, the first fixed behavior information includes p behavior information H-A1~H-Ap, the first flexible behavior information includes q behavior information F-A1~F-Aq, and p and q are positive integers. The first decoding module 501 includes a fixed decoding submodule 5011 and a configurable decoding submodule 5012. The fixed decoding submodule 5011 includes p fixed decoders 1~p, and the configurable decoding submodule 5012 includes q configurable decoders 1~q. The fixed decoders 1~p correspondingly normalize the behavior information H-A1~H-Ap to obtain normalized behavior information U-H-A1~U-H-Ap, and the fixed decoders 1~p respectively output the behavior information U-H-A1~U-H-Ap to fixed positions of the third data bus. The configurable decoders 1~q correspondingly normalize the behavior information F-A1~F-Aq to obtain normalized behavior information U-F-A1~U-F-Aq, and each configurable decoder in the configurable decoders 1~q outputs the normalized flexible behavior information to an arbitrary position of the third data bus. The process in which the second decoding module 502 normalizes the second behavior information can refer to the process in which the first decoding module 501 normalizes the first behavior information. Figure 5 and the related description, which will not be repeated here.

[0147] The arbitration unit 40 arbitrates the first behavior information and the second behavior information to obtain arbitration behavior information. In an optional embodiment, Figure 6 and Figure 7 Figures 1 and 2 show schematic diagrams of two ACL processing apparatuses provided by embodiments of the present application, and Figure 3 and Figure 4 Based on the ACL processing apparatus shown in Figures 1 and 2, Figure 6 and Figure 7 The ACL processing apparatus shown in Figures 1 and 2 further includes an execution unit 60. The execution unit 60 is connected to the arbitration unit 40. The execution unit 60 is configured to perform an operation behavior indicated by the arbitration behavior information on the first packet. Since the first behavior information and the second behavior information can each be a behavior information set, the arbitration behavior information can also be a behavior information set. The arbitration behavior information includes a plurality of behavior information, each of which is configured to indicate an operation behavior, and the operation behaviors indicated by the plurality of behavior information are different. In one example, the operation behavior indicated by the arbitration behavior information includes packet loss (i.e., packet discard), and the execution unit 60 discards the first packet. In another example, the operation behavior indicated by the arbitration behavior information includes packet redirection, and the execution unit 60 redirects the first packet. In yet another example, the operation behavior indicated by the arbitration behavior information includes traffic statistics, and the execution unit 60 performs traffic statistics on the first packet.

[0148] In an optional embodiment, Figure 8is a schematic diagram of another ACL processing apparatus provided by an embodiment of the present application. The ACL processing apparatus comprises an obtaining unit 10, a constructing unit 20, a searching unit 30, an arbitrating unit 40, a decoding unit 50, and an executing unit 60. The obtaining unit 10, the constructing unit 20, the searching unit 30, the decoding unit 50, the arbitrating unit 40, and the executing unit 60 are connected in sequence. The obtaining unit 10 comprises a configurable extraction module 101 and a plurality of fixed extraction modules, and the configurable extraction module 101 comprises m configurable extraction sub-modules. The details of the configurable extraction module 101 can be referred to the foregoing description, and will not be described herein. Figure 8 For example, the plurality of fixed extraction modules are fixed extraction modules 1-k, the fixed extraction modules 1-k correspond to protocol layers 1-k one by one, the fixed extraction module 1 is used to extract fixed information of the protocol layer 1 from the first message information, the fixed extraction module 2 is used to extract fixed information of the protocol layer 2 from the first message information, the fixed extraction module 3 is used to extract fixed information of the protocol layer 3 from the first message information, and so on. It should be noted that the protocol layers 1-k described herein are only used to express the number of protocol layers and the correspondence between the protocol layers and the fixed extraction modules, and each of the protocol layers 1-k can be any actual protocol layer. For example, the protocol layer 1 is an L2 protocol layer, the protocol layer 2 is an L3 protocol layer, the protocol layer 3 is an L4 protocol layer, and so on. For another example, the protocol layer 2 is an L2 protocol layer, the protocol layer 3 is an L3 protocol layer, the protocol layer 4 is an L4 protocol layer, and so on. Optionally, the obtaining unit 10 and the constructing unit 20 are connected through a first data bus, the first data bus comprises a fixed part and a flexible part, the fixed part comprises fixed positions (for example, fixed bit widths, also referred to as fixed byte positions) corresponding to the protocol layers 1-k one by one, and each of the fixed extraction modules 1-k outputs fixed information of a corresponding protocol layer to a corresponding fixed position of the first data bus after extracting the fixed information, and the configurable extraction module 101 outputs flexible information to any position of the flexible part of the first data bus after extracting the flexible information.

[0149] In an optional embodiment, each of the plurality of fixed extraction modules comprises a selection sub-module and at least one fixed extraction sub-module connected to the selection sub-module, the at least one fixed extraction sub-module corresponding to at least one message type belonging to a protocol layer corresponding to the each fixed extraction module. Each of the at least one fixed extraction sub-module is configured to extract target information of the message type corresponding to the each fixed extraction sub-module from the first message information. The selection sub-module is configured to determine fixed information of the protocol layer corresponding to the each fixed extraction module according to the type information of the first message corresponding to the each fixed extraction module and the target information extracted from the first message information by the at least one fixed extraction sub-module, the first message information comprising the type information corresponding to the each fixed extraction module, the type information of the first message corresponding to the each fixed extraction module indicating a message type of the first message corresponding to the protocol layer corresponding to the each fixed extraction module. Figure 8Taking each of the k fixed extraction modules as an example, each of the fixed extraction modules includes a selection submodule and n fixed extraction submodules, where n is a positive integer. For ease of description, the selection submodule included in the fixed extraction module 1 is referred to as selection submodule 1, the n fixed extraction submodules included in the fixed extraction module 1 are referred to as fixed extraction submodules 11~1n, the selection submodule included in the fixed extraction module 2 is referred to as selection submodule 2, the n fixed extraction submodules included in the fixed extraction module 2 are referred to as fixed extraction submodules 21~2n, and so on. The selection submodule included in the fixed extraction module k is referred to as selection submodule k, and the n fixed extraction submodules included in the fixed extraction module k are referred to as fixed extraction submodules k1~kn. The fixed extraction modules 1~k correspond to the protocol layers 1~k one-to-one. The fixed extraction submodules 11~1n are connected to the selection submodule 1, the fixed extraction submodules 21~2n are connected to the selection submodule 2, and so on. The fixed extraction submodules k1~kn are connected to the selection submodule k. The fixed extraction submodules 11~1n correspond to the n message types (assuming message types 11~1n) of the protocol layer 1 one-to-one. The fixed extraction submodule 11 is configured to extract target information of the message type 11 from the first message information, the fixed extraction submodule 12 is configured to extract target information of the message type 12 from the first message information, and so on. The fixed extraction submodule 1n is configured to extract target information of the message type 1n from the first message information. The selection submodule 1 is configured to determine the fixed information of the protocol layer (i.e., the protocol layer 1) corresponding to the fixed extraction submodule 1 according to the type information 1 (the type information of the first message corresponding to the fixed extraction module 1, i.e., the type information belonging to the protocol layer 1) and the target information extracted from the first message information by the fixed extraction submodules 11~1n. Similarly, the fixed extraction submodules 21~2n correspond to the n message types (assuming message types 21~2n) of the protocol layer 2 one-to-one. The fixed extraction submodule 21 is configured to extract target information of the message type 21 from the first message information, the fixed extraction submodule 22 is configured to extract target information of the message type 22 from the first message information, and so on. The fixed extraction submodule 2n is configured to extract target information of the message type 2n from the first message information. The selection submodule 2 is configured to determine the fixed information of the protocol layer (i.e., the protocol layer 2) corresponding to the fixed extraction submodule 2 according to the type information 2 (the type information of the first message corresponding to the fixed extraction module 2, i.e., the type information belonging to the protocol layer 2) and the target information extracted from the first message information by the fixed extraction submodules 22~2n. And so on.

[0150] In an optional embodiment, the constructing unit 20 is further configured to construct a plurality of key information according to the basic information set, the plurality of key information comprising the first key information and the second key information; the searching unit 30 is further configured to search the ACL rule library according to the plurality of key information to obtain a plurality of target behavior information corresponding to the plurality of key information, the plurality of target behavior information comprising the first behavior information and the second behavior information; and the arbitrating unit 40 is configured to arbitrate the plurality of target behavior information. In an example,

[0151] The constructing unit 20 comprises a plurality of constructing modules, the searching unit 30 comprises a plurality of searching modules, and the decoding unit 50 comprises a plurality of decoding modules, Figure 8With the plurality of construction modules being w construction modules, the plurality of lookup modules being w lookup modules, and the plurality of decoding modules being w decoding modules as an example, w is an integer greater than 1. The plurality of construction modules are respectively connected with the acquisition unit 10, and the plurality of construction modules are connected with the plurality of lookup modules in one-to-one correspondence, and the plurality of decoding modules are connected with the plurality of lookup modules in one-to-one correspondence. The plurality of construction modules include a first construction module 201 and a second construction module 202 (the first construction module 201 and the second construction module 202 are any two construction modules in the plurality of construction modules), the plurality of lookup modules include a first lookup module 301 and a second lookup module 302 (the first lookup module 301 and the second lookup module 302 are any two lookup modules in the plurality of lookup modules), and the plurality of decoding modules include a first decoding module 501 and a second decoding module 502 (the first decoding module 501 and the second decoding module 502 are any two decoding modules in the plurality of decoding modules). The plurality of construction modules are used to construct a plurality of key information according to the basic information set constructed by the acquisition unit 10, the plurality of key information corresponds to the plurality of construction modules in one-to-one correspondence (that is, each construction module in the plurality of construction modules constructs a key information according to the basic information set), and the plurality of key information includes a first key information and a second key information. The plurality of lookup modules are used to find a plurality of target behavior information according to the plurality of key information from the ACL rule library, the plurality of target behavior information corresponds to the plurality of key information in one-to-one correspondence (that is, each lookup module in the plurality of lookup modules finds a target behavior information according to the key information constructed by the corresponding construction module from the ACL rule library), the plurality of target behavior information is included in the ACL rule library, the plurality of key information matches the ACL rule library, and the plurality of target behavior information includes a first behavior information and a second behavior information. The plurality of decoding modules are used to normalize the plurality of target behavior information in one-to-one correspondence. The arbitration unit 40 is used to arbitrate the plurality of target behavior information (that is, the arbitration unit 40 is used to arbitrate the plurality of target behavior information after normalization). For example, at least two target behavior information in the plurality of target behavior information includes fixed behavior information and flexible behavior information, the arbitration unit 40 is used to arbitrate the fixed behavior information included in the plurality of target behavior information, and arbitrate the flexible behavior information included in the plurality of target behavior information. For example, the arbitration unit 40 includes a fixed arbitration module 401 and a configurable arbitration module 402, the fixed arbitration module 401 is used to arbitrate the fixed behavior information included in the plurality of target behavior information, and the configurable arbitration module 402 is used to arbitrate the flexible behavior information included in the plurality of target behavior information. For example, the fixed arbitration module 401 de-duplicates and merges the fixed behavior information included in the plurality of target behavior information to obtain arbitrated fixed behavior information, and the configurable arbitration module 402 de-duplicates and merges the flexible behavior information included in the plurality of target behavior information to obtain arbitrated flexible behavior information.The arbitration unit 40 is configured to arbitrate the plurality of target behavior information to obtain arbitration behavior information, and the execution unit 60 is configured to perform an operation behavior indicated by the arbitration behavior information on the first packet.

[0152] In one example, referring to Figure 8 , the constructing module 1 is configured to construct key information 1 according to the basic information set constructed by the obtaining unit 10, the searching module 1 is configured to search the ACL rule library according to the key information 1 to obtain target behavior information 1, and the decoding module 1 is configured to normalize the target behavior information 1 to obtain normalized target behavior information 1. The constructing module 2 is configured to construct key information 2 according to the basic information set constructed by the obtaining unit 10, the searching module 2 is configured to search the ACL rule library according to the key information 2 to obtain target behavior information 2, and the decoding module 2 is configured to normalize the target behavior information 2 to obtain normalized target behavior information 2. The constructing module 3 is configured to construct key information 3 according to the basic information set constructed by the obtaining unit 10, the searching module 3 is configured to search the ACL rule library according to the key information 3 to obtain target behavior information 3, and the decoding module 3 is configured to normalize the target behavior information 3 to obtain normalized target behavior information 3. In this way, the constructing module w is configured to construct key information w according to the basic information set constructed by the obtaining unit 10, the searching module w is configured to search the ACL rule library according to the key information w to obtain target behavior information w, and the decoding module w is configured to normalize the target behavior information w to obtain normalized target behavior information w. The arbitration unit 40 is configured to arbitrate the normalized target behavior information 1-w to obtain arbitration behavior information, and the execution unit 60 is configured to perform an operation behavior indicated by the arbitration behavior information on the first packet.

[0153] It should be noted that, similar to Figure 4 and Figure 7 , the decoding module in Figure 8 may also include a fixed decoding submodule and a configurable decoding submodule. For example, the decoding module 1 includes a fixed decoding submodule 11 and a configurable decoding submodule 12, the fixed decoding submodule 11 is configured to normalize fixed behavior information included in the target behavior information 1, and the configurable decoding submodule 12 is configured to normalize flexible behavior information included in the target behavior information 1. The decoding module 2 includes a fixed decoding submodule 21 and a configurable decoding submodule 22, the fixed decoding submodule 21 is configured to normalize fixed behavior information included in the target behavior information 2, and the configurable decoding submodule 22 is configured to normalize flexible behavior information included in the target behavior information 2. In this way, the decoding module w includes a fixed decoding submodule w1 and a configurable decoding submodule w2, the fixed decoding submodule w1 is configured to normalize fixed behavior information included in the target behavior information w, and the configurable decoding submodule w2 is configured to normalize flexible behavior information included in the target behavior information w. Figure 8For brevity, the detailed structure of the decoding module is not shown. Figure 8 The at least one decoding module in the above embodiment can also be implemented in other structures, which are not limited in the embodiments of the present application.

[0154] In the embodiments of the present application, the at least one fixed extraction module includes an application specific integrated circuit (ASIC). For example, the at least one fixed extraction submodule included in the fixed extraction module is implemented by using an ASIC, and the selection submodule included in the fixed extraction module is implemented by using an ASIC or a configurable circuit. The fixed extraction submodule can also be referred to as a fixed extraction circuit, a fixed extractor, a hard extraction extractor, a hard block, etc., and the selection submodule can also be referred to as a selection circuit, a selector, etc. The configurable extraction module includes a configurable circuit. For example, the at least one configurable extraction submodule included in the configurable extraction module is implemented by using a configurable circuit, and the configurable extraction submodule can also be referred to as a configurable extraction circuit, a configurable extractor, a flexible extraction extractor, a flexible block, etc. The construction module, the lookup module, the parsing module, etc. can be implemented by using an ASIC or a configurable circuit. The fixed arbitration module can be implemented by using an ASIC, and the configurable extraction module, the configurable arbitration module, etc. can be implemented by using a configurable circuit. The arbitration module can include an arbitration circuit, and the arbitration circuit includes a selector and can also include other circuit devices. Optionally, the lookup unit is a TCAM, the ACL rule library is deployed in the TCAM, and each lookup module included in the lookup unit is a functional module of the TCAM. In addition, in the description process, all the fixed extraction modules are taken as an example to be explained, and actually, the number of the fixed extraction submodules included in different fixed extraction modules can be equal or not equal, which is not limited in the embodiments of the present application.

[0155] The embodiments of the present application independently describe the obtaining unit and the constructing unit, and independently describe the decoding unit and the arbitration unit. According to the above embodiments, the overall role of the obtaining unit and the constructing unit is to construct the lookup key information (i.e. the lookup key information such as the first key information described above), and the overall role of the decoding unit and the arbitration unit is to perform behavior information arbitration. Therefore, in some embodiments, the obtaining unit and the constructing unit are collectively referred to as the constructing unit, and the decoding unit and the arbitration unit are collectively referred to as the decoding arbitration unit. In fact, the functions of the obtaining unit and the functions of the constructing unit can be implemented by one unit, and the functions of the decoding unit and the functions of the arbitration unit can also be implemented by one unit, for example, the functions of the constructing unit are integrated into the obtaining unit, and the functions of the decoding unit are integrated into the arbitration unit. Network service diversification development requires ACL processing devices to have stronger performance, flexibility and expansion capability. The embodiments of the present application mainly consider designing ACL processing devices from two aspects of key information construction (specifically, obtaining of the basic information set) and behavior information arbitration, so that the ACL processing device has smaller resource consumption, better performance, and higher flexibility and expansion capability. For example, it can be found that many basic ACL processing functions are relatively stable, and are often around the five-tuple, and other message information is added according to the service needs, so as to achieve. As long as the stable ACL application service (i.e. the service applying the ACL rule) is extracted, it can be determined which message information is often used as the matching item of the ACL rule, and combined with the stability of the evolution of the internet protocol (internet protocol, IP) protocol and service application, it can be determined which message information is likely to be used as the matching item of the ACL rule in the future. Based on this logic, the present application mainly considers designing the ACL processing device from the following two aspects.

[0156] On the one hand, the present application considers dividing the message information into mature information (or stable information) and immature information (or unstable information) from the perspective of ACL application maturity. In the process of obtaining the basic information set, the mature information (such as five-tuple, three-tuple, etc.) in the first message information is extracted by the fixed extraction module in the obtaining unit, and the immature information (such as some information in the VXLAN tunnel header that may be added in the protocol evolution and used for ACL processing, etc.) in the first message information is extracted by the configurable extraction module in the obtaining unit. Since the mature information is extracted by the fixed extraction module, the resource consumption of the obtaining unit is small and the performance is high. Since the immature information is extracted by the configurable extraction module, the configurable extraction module can flexibly cope with the definition changes of the immature information, so the obtaining unit has certain flexibility and expansion capability.

[0157] In another aspect, the operation behaviors are divided into mature behaviors (or stable behaviors) and under-mature behaviors (or under-stable behaviors) from the perspective of ACL application maturity, for example, the mature behaviors include packet dropping (i.e. packet discarding), packet redirection, priority modification, mirror enabling, sample enabling, etc., and the under-mature behaviors include telemetry, forward type modification, etc. In the process of decoding the behavior information, the mature behavior information (the behavior information used to indicate the mature behaviors) is decoded by the fixed decoding sub-modules in the decoding unit, and the under-mature behavior information (the behavior information used to indicate the under-mature behaviors) is decoded by the configurable decoding sub-modules in the decoding unit. Since the mature behavior information is decoded by the fixed decoding sub-modules, the decoding unit has less resource overhead and higher performance. Since the under-mature behavior information is decoded by the configurable decoding sub-modules, the decoding unit has certain flexibility and expansion capability. For example, the lookup unit and the decoding unit are connected through the second data bus, the fixed decoding sub-modules are deployed according to fixed bit width and fixed position (for example, the fixed decoding sub-modules are connected with the positions corresponding to the partial fixed bit width of the second data bus) to minimize resource overhead, and the configurable decoding sub-modules are deployed according to flexible bit width and flexible position (for example, the configurable decoding sub-modules are connected with the positions corresponding to the overall bit width of the second data bus) to improve flexibility. In the process of arbitrating the behavior information, the mature behavior information is arbitrated by the fixed arbitration modules in the arbitration unit, and the under-mature behavior information is arbitrated by the configurable arbitration modules in the arbitration unit. Since the mature behavior information is arbitrated by the fixed arbitration modules, the arbitration unit has less resource overhead and higher performance. Since the under-mature behavior information is arbitrated by the configurable arbitration modules, the arbitration unit has certain flexibility and expansion capability. For example, the arbitration unit and the decoding unit are connected through the third data bus, the fixed arbitration modules are deployed according to fixed bit width and fixed position (for example, the fixed arbitration modules are connected with the positions corresponding to the partial fixed bit width of the third data bus) to minimize resource overhead, and the configurable arbitration modules are deployed according to flexible bit width and flexible position (for example, the configurable arbitration modules are connected with the positions corresponding to the overall bit width of the third data bus) to improve flexibility.

[0158] The operation behaviors generally include flow classification behaviors and forwarding behaviors, for example, packet dropping, packet redirection, priority modification, mirror enabling, sampling enabling, and the like all belong to flow classification behaviors. Since the length of flow classification behavior information (i.e., behavior information used for indicating flow classification behaviors) is less than the length of forwarding behavior information (i.e., behavior information used for indicating forwarding behaviors), and the length difference between the flow classification behavior information and the forwarding behavior information is relatively large, for example, the length of the forwarding behavior information is up to 60 bits. If the forwarding behavior information is deployed in a hardening manner, the bit width of the fixed decoding sub-module and the fixed arbitration module needs to be set relatively large, which is easy to cause a relatively large resource overhead. Therefore, the forwarding behavior information can be flexibly deployed, the forwarding behavior information is decoded by using a configurable decoding sub-module, and the forwarding behavior information is arbitrated by using a configurable arbitration module, so as to reduce the resource overhead of the ACL processing device. The ACL processing device can not only reduce the resource overhead and improve the performance of the ACL processing device, but also has a certain flexibility and expansion capability to support future service expansion, and a reasonable trade-off between flexibility and performance is achieved.

[0159] In summary, the technical scheme provided by the embodiment of the present application is that the acquisition unit in the ACL processing device includes a fixed extraction function and a configurable extraction function, so that the flexibility and expansion capability of the acquisition unit are relatively high, and the resource overhead of the acquisition unit is relatively small. The ACL processing device has relatively high flexibility and expansion capability, and has relatively small resource overhead. For example, the acquisition unit includes a configurable extraction module and a fixed extraction module, the function of the fixed extraction module is fixed, and the function of the configurable extraction module is configurable, so that the resource overhead of the acquisition unit can be reduced, and the flexibility and expansion capability of the acquisition unit can be improved. Further, the arbitration unit in the ACL processing device includes a fixed arbitration module and a configurable arbitration module, the function of the fixed arbitration module is fixed, and the function of the configurable arbitration module is configurable, so that the resource overhead of the arbitration unit can be reduced, and the flexibility and expansion capability of the arbitration unit can be improved. In addition, the decoding unit in the ACL processing device includes a fixed decoding sub-module and a configurable decoding sub-module, the function of the fixed decoding sub-module is fixed, and the function of the configurable arbitration module is configurable, so that the resource overhead of the decoding unit can be reduced, and the flexibility and expansion capability of the decoding unit can be improved. Since the resource overhead of the acquisition unit, the arbitration unit and the decoding unit is relatively small, and the flexibility and expansion capability is relatively high, the resource overhead of the ACL processing device is relatively small, and the flexibility and expansion capability is relatively high.

[0160] The above is the introduction of the embodiment of the ACL processing device of the present application, and the embodiment of the ACL processing method is introduced below.

[0161] Figure 9is a flow chart of an ACL processing method provided by an embodiment of the present application. The ACL processing method is applied to an ACL processing device. As shown in Figure 9 , the ACL processing method comprises the following steps S901 to S903.

[0162] S901. Obtain a basic information set according to first message information, the first message information being information related to a first message, the basic information set comprising at least one basic information related to the first message.

[0163] Optionally, the ACL processing device comprises an obtaining unit configured to obtain the basic information set according to the first message information.

[0164] Please refer to Figure 10 , S901 comprises the following sub-steps S9011 and S9012.

[0165] S9011. Extract flexible information from the first message information according to user configuration information, the basic information in the basic information set comprising the flexible information.

[0166] The obtaining unit extracts the flexible information from the first message information according to the user configuration information. For example, the obtaining unit comprises a configurable extraction module configured to extract the flexible information from the first message information according to the user configuration information. Optionally, the configurable extraction module comprises a plurality of configurable extraction sub-modules, at least two configurable extraction sub-modules in the plurality of configurable extraction sub-modules having different bit widths. Each configurable extraction sub-module in the plurality of configurable extraction sub-modules extracts the flexible information from the first message information according to the user configuration information and the bit width of the each configurable extraction sub-module, the basic information in the basic information set comprising the flexible information extracted from the first message information by the plurality of configurable extraction sub-modules.

[0167] S9012. Extract fixed information of a first protocol layer from the first message information, the basic information in the basic information set comprising the fixed information of the first protocol layer.

[0168] The obtaining unit extracts the fixed information of the first protocol layer from the first message information. Optionally, the obtaining unit extracts target information of a first message type from the first message information, and determines the fixed information of the first protocol layer according to the first type information and the target information of the first message type. The first message type belongs to the first protocol layer, the first type information is used to indicate the message type of the first message corresponding to the first protocol layer, and the first message information comprises the first type information.

[0169] Optionally, the obtaining unit comprises a first fixed extraction module, the first fixed extraction module is fixed to the first protocol layer, and the first fixed extraction module extracts the fixed information of the first protocol layer from the first message information. For example, the first fixed extraction module extracts the target information of the first message type from the first message information, and the first fixed extraction module determines the fixed information of the first protocol layer according to the first type information and the target information of the first message type. For example, the first fixed extraction module comprises a first selection sub-module and at least one first fixed extraction sub-module, the at least one first fixed extraction sub-module is connected with the first selection sub-module, the at least one first fixed extraction sub-module one-to-one corresponds to at least one first message type, and the at least one first message type belongs to the first protocol layer. Each of the at least one first fixed extraction sub-module extracts the target information of the first message type corresponding to each of the at least one first fixed extraction sub-module from the first message information, and the first selection sub-module determines the fixed information of the first protocol layer according to the first type information and the target information extracted from the first message information by the at least one first fixed extraction sub-module.

[0170] Optionally, please continue to refer to Figure 10 S901 further comprises the following sub-step S9013.

[0171] S9013. Extract the fixed information of the second protocol layer from the first message information, and the basic information in the basic information set further comprises the fixed information of the second protocol layer.

[0172] The obtaining unit extracts the fixed information of the second protocol layer from the first message information. Optionally, the obtaining unit extracts the target information of the second message type from the first message information, and the obtaining unit determines the fixed information of the second protocol layer according to the second type information and the target information of the second message type. Wherein, the second message type belongs to the second protocol layer, the second type information is used to indicate the message type of the first message corresponding to the second protocol layer, and the first message information comprises the second type information.

[0173] Optionally, the obtaining unit comprises a second fixed extraction module, the second fixed extraction module is fixed to the second protocol layer, and the second fixed extraction module extracts the fixed information of the second protocol layer from the first message information. For example, the second fixed extraction module extracts the target information of the second message type from the first message information, and the second fixed extraction module determines the fixed information of the second protocol layer according to the second type information and the target information of the second message type. For example, the second fixed extraction module comprises a second selection submodule and at least one second fixed extraction submodule, the at least one second fixed extraction submodule is connected with the second selection submodule, the at least one second fixed extraction submodule one-to-one corresponds to at least one second message type, and the at least one second message type belongs to the second protocol layer. Each of the at least one second fixed extraction submodule extracts the target information of the second message type corresponding to the second fixed extraction submodule from the first message information; and the second selection submodule determines the fixed information of the second protocol layer according to the second type information and the target information extracted by the at least one second fixed extraction submodule from the first message information.

[0174] Optionally, the obtaining unit extracts the fixed information of a plurality of protocol layers from the first message information, and the plurality of protocol layers comprises the first protocol layer and the second protocol layer. For example, the obtaining unit comprises a plurality of fixed extraction modules, the plurality of fixed extraction modules are fixed one-to-one to a plurality of protocol layers, the plurality of fixed extraction modules comprises the first fixed extraction module and the second fixed extraction module, each of the plurality of fixed extraction modules extracts the fixed information of the protocol layer corresponding to the fixed extraction module from the first message information, and the basic information in the basic information set comprises the fixed information extracted by the plurality of fixed extraction modules from the first message information. For example, each of the plurality of fixed extraction modules comprises a selection submodule and at least one fixed extraction submodule, the at least one fixed extraction submodule is connected with the selection submodule, the at least one fixed extraction submodule one-to-one corresponds to at least one message type, and the at least one message type belongs to the protocol layer corresponding to the fixed extraction module; each of the at least one fixed extraction submodule extracts the target information of the message type corresponding to the fixed extraction submodule from the first message information; and the selection submodule determines the fixed information of the protocol layer corresponding to the fixed extraction module according to the type information of the first message corresponding to the fixed extraction module and the target information extracted by the at least one fixed extraction submodule from the first message information, and the type information of the first message corresponding to the fixed extraction module is used to indicate the message type of the first message corresponding to the protocol layer corresponding to the fixed extraction module.

[0175] S902. Constructing the first key information according to the basic information set, and the first key information comprises at least one basic information in the basic information set.

[0176] The ACL processing apparatus can comprise a constructing unit configured to construct the first key information according to the basic information set. For example, the constructing unit comprises a first constructing module configured to construct the first key information according to the basic information set.

[0177] S903. Searching the ACL rule library according to the first key information.

[0178] The ACL processing apparatus can comprise a searching unit configured to search the ACL rule library according to the first key information. For example, the searching unit comprises a first searching module connected to the first constructing module, and the first searching module is configured to search the ACL rule library according to the first key information constructed by the first constructing module to obtain the first behavior information.

[0179] In optional embodiments, after S901, the ACL processing method comprises steps S904-S905.

[0180] S904. Constructing second key information according to the basic information set, the second key information comprising at least one of the basic information set.

[0181] Optionally, the constructing unit is configured to construct the second key information according to the basic information set. For example, the constructing unit comprises a second constructing module configured to construct the second key information according to the basic information set.

[0182] S905. Searching the ACL rule library according to the second key information.

[0183] Optionally, the searching unit is configured to search the ACL rule library according to the second key information to obtain the second behavior information. For example, the searching unit comprises a second searching module connected to the second constructing module, and the second searching module is configured to search the ACL rule library according to the second key information constructed by the second constructing module to obtain the second behavior information.

[0184] Optionally, the ACL processing apparatus constructs a plurality of key information according to the basic information set, the plurality of key information comprising the first key information and the second key information; and the ACL processing apparatus looks up the ACL rule library according to the plurality of key information to obtain a plurality of target behavior information corresponding to the plurality of key information, the plurality of target behavior information comprising the first behavior information and the second behavior information. For example, the ACL processing apparatus comprises a constructing unit and a looking-up unit, the constructing unit comprises a plurality of constructing modules, the looking-up unit comprises a plurality of looking-up modules, the plurality of constructing modules are connected to the plurality of looking-up modules in a one-to-one correspondence, and the plurality of constructing modules construct the plurality of key information according to the basic information set. For example, each of the plurality of constructing modules constructs one key information according to the basic information set. The plurality of looking-up modules look up the ACL rule library according to the plurality of key information to obtain the plurality of target behavior information corresponding to the plurality of key information. For example, each of the plurality of looking-up modules looks up the ACL rule library according to the corresponding key information to obtain the corresponding target behavior information.

[0185] In the optional embodiment, after S903 and S905, the ACL processing method comprises the following step S906.

[0186] S906. Arbitrating the first behavior information and the second behavior information to obtain arbitration behavior information, the first behavior information being behavior information obtained by looking up the ACL rule library according to the first key information, and the second behavior information being behavior information obtained by looking up the ACL rule library according to the second key information.

[0187] Optionally, the first behavior information is behavior information obtained by the looking-up unit looking up the ACL rule library according to the first key information, and the second behavior information is behavior information obtained by the looking-up unit looking up the ACL rule library according to the second key information. The ACL processing apparatus further comprises an arbitration unit configured to arbitrate the first behavior information and the second behavior information to obtain arbitration behavior information. For example, the first behavior information and the second behavior information each comprise a plurality of behavior information, and the arbitration unit is configured to de-merge and combine the first behavior information and the second behavior information to arbitrate the first behavior information and the second behavior information.

[0188] In one embodiment, the first behavior information and the second behavior information respectively comprise fixed behavior information and flexible behavior information, the arbitration unit arbitrates the fixed behavior information comprised in the first behavior information and the fixed behavior information comprised in the second behavior information to obtain arbitration fixed behavior information, and arbitrates the flexible behavior information comprised in the first behavior information and the flexible behavior information comprised in the second behavior information to obtain arbitration flexible behavior information. For example, the arbitration unit comprises a fixed arbitration module and a configurable arbitration module, the fixed arbitration module arbitrates the fixed behavior information comprised in the first behavior information and the fixed behavior information comprised in the second behavior information, and the configurable arbitration module arbitrates the flexible behavior information comprised in the first behavior information and the flexible behavior information comprised in the second behavior information. For example, the fixed arbitration module de-duplicates and merges the fixed behavior information comprised in the first behavior information and the fixed behavior information comprised in the second behavior information to obtain the arbitration fixed behavior information, and the configurable arbitration module de-duplicates and merges the flexible behavior information comprised in the first behavior information and the flexible behavior information comprised in the second behavior information to obtain the arbitration flexible behavior information. After obtaining the arbitration fixed behavior information, the fixed arbitration module can output the arbitration fixed behavior information through a fixed part of an output interface of the arbitration unit. After obtaining the arbitration flexible behavior information, the configurable arbitration module can output the arbitration flexible behavior information through a flexible part of the output interface of the arbitration unit.

[0189] Optionally, the searching unit searches the ACL rule library according to the plurality of key information to obtain a plurality of target behavior information, the plurality of target behavior information comprises the first behavior information and the second behavior information, and the arbitration unit arbitrates the plurality of target behavior information. For example, at least two target behavior information in the plurality of target behavior information comprise fixed behavior information and flexible behavior information, the fixed arbitration module comprised in the arbitration unit arbitrates the fixed behavior information comprised in the plurality of target behavior information. The configurable arbitration module comprised in the arbitration unit arbitrates the flexible behavior information comprised in the plurality of target behavior information.

[0190] In an optional embodiment, before S906, the ACL processing apparatus normalizes the first behavior information and the second behavior information. In S906, the ACL processing apparatus arbitrates the normalized first behavior information and the normalized second behavior information. The ACL processing apparatus normalizes the first behavior information and the second behavior information, so that the first behavior information and the second behavior information are in a uniform format, and arbitration processing is facilitated. In an example, the ACL processing apparatus further includes a decoding unit that normalizes the first behavior information and the second behavior information. In an embodiment, the decoding unit includes a first decoding module and a second decoding module, the first decoding module normalizes the first behavior information, and the second decoding module normalizes the second behavior information. Optionally, the first decoding module normalizes fixed behavior information included in the first behavior information, and the first decoding module normalizes flexible behavior information included in the first behavior information. For example, the first decoding module includes a fixed decoding submodule and a configurable decoding submodule, the fixed decoding submodule included in the first decoding module normalizes the fixed behavior information included in the first behavior information, and the configurable decoding submodule included in the first decoding module normalizes the flexible behavior information included in the first behavior information. Similarly, the second decoding module normalizes fixed behavior information included in the second behavior information, and the second decoding module normalizes flexible behavior information included in the second behavior information. For example, the second decoding module includes a fixed decoding submodule and a configurable decoding submodule, the fixed decoding submodule included in the second decoding module normalizes the fixed behavior information included in the second behavior information, and the configurable decoding submodule included in the second decoding module normalizes the flexible behavior information included in the second behavior information.

[0191] Optionally, the lookup unit includes a plurality of lookup modules, and the decoding unit includes a plurality of decoding modules, the plurality of decoding modules are connected to the plurality of lookup modules in one-to-one correspondence, the plurality of decoding modules normalize a plurality of target behavior information obtained by the plurality of lookup modules searching the ACL rule library in one-to-one correspondence, to obtain normalized plurality of target behavior information. The arbitration unit arbitrates the normalized plurality of target behavior information.

[0192] In an optional embodiment, after S906, the ACL processing method includes the following step S907.

[0193] S907. Perform an operation behavior indicated by the arbitration behavior information on the first packet.

[0194] The ACL processing apparatus can include an execution unit that performs an operation behavior indicated by the arbitration behavior information on the first packet.

[0195] In summary, the technical scheme provided by the embodiments of the present application, the ACL processing device can extract the fixed information of the first protocol layer from the first message information, and can extract the flexible information from the first message information according to the user configuration information, so that the ACL processing device includes the fixed extraction function and the configurable extraction function, the flexibility and the expansion capability of the ACL processing device are higher, and the resource consumption is smaller. Further, the ACL processing device can arbitrate the fixed behavior information and the flexible behavior information respectively, so that the ACL processing device includes the fixed arbitration function and the configurable arbitration function, the flexibility and the expansion capability of the ACL processing device are higher, and the resource consumption is smaller. In addition, the ACL processing device can decode the fixed behavior information and the flexible behavior information respectively, the ACL processing device includes the fixed decoding function and the configurable decoding function, the flexibility and the expansion capability of the ACL processing device are higher, and the resource consumption is smaller.

[0196] The embodiments of the present application also provide a forwarding chip, which comprises the ACL processing device as shown in any one of Figures 1 to 4 、 Figures 6 to 8 The forwarding chip can be an application-specific integrated circuit (ASIC) chip, a field-programmable gate array (FPGA) chip or a generic array logic (GAL) chip and various possible chips. The forwarding chip comprises a programmable logic circuit and / or program instructions, and the forwarding chip is used to implement at least part of the steps of the ACL processing method provided by the embodiments as shown in Figure 9 or Figure 10 The architecture of the forwarding chip can be an RTC architecture or a pipeline architecture.

[0197] In one embodiment, Figure 11 is a schematic diagram of an RTC architecture forwarding chip provided by the embodiments of the present application, which comprises a processor core, a TCAM array and an ACL processing device, and the processor core is connected with the TCAM array. The ACL processing device comprises an acquisition unit 10, a construction unit 20 and a lookup unit 30, and the acquisition unit 10, the construction unit 20 and the lookup unit 30 are connected in sequence. The processor core comprises the acquisition unit 10, the TCAM array comprises the construction unit 20 and the lookup unit 30. Optionally, the ACL processing device further comprises an arbitration unit 40, a decoding unit 50 and an execution unit 60, and the lookup unit 30, the decoding unit 50, the arbitration unit 40 and the execution unit 60 are connected in sequence, the TCAM array further comprises the arbitration unit 40 and the decoding unit 50, and the processor core further comprises the execution unit 60.

[0198] In another embodiment, Figure 12 is a schematic diagram of a forwarding chip of a pipeline architecture provided in an embodiment of the present application. The forwarding chip includes a plurality of processing nodes connected in sequence, which can be match-action (MA) nodes. At least one of the plurality of processing nodes includes an ACL processing apparatus provided in the present application. Figure 12 For example, the forwarding chip includes X processing nodes, and processing node 3 includes the ACL processing apparatus. Each of the plurality of processing nodes performs a processing operation according to a processing result output by a previous processing node.

[0199] Figure 11 and Figure 12 The ACL processing apparatus included in the forwarding chip shown in Figures 1 to 7 is not repeated here. Optionally, the forwarding chip provided in the present application is a network processor (NP) chip.

[0200] Since the ACL processing apparatus provided in the present application has a small resource overhead, the forwarding chip including the ACL processing apparatus has a small resource overhead, a small area, and a low cost. Since the ACL processing apparatus has high flexibility and good scalability, the forwarding chip including the ACL processing apparatus has high flexibility and good scalability. The forwarding chip provided in the present application has high performance and a good performance power area (PPA).

[0201] An embodiment of the present application further provides a network device including the forwarding chip described above. The network device can be any network device for service forwarding in a communication network. For example, according to the type of the device, the network device can be a switch, a router, or the like. According to the deployment location of the device, the network device can be an edge network device or a core network device.

[0202] As an example, refer to Figure 13 which shows a schematic diagram of a network device 1300 provided in an embodiment of the present application. The network device 1300 includes a processor 1302, a memory 1304, a communication interface 1306, a forwarding chip 1308, and a bus 1310. The processor 1302, the memory 1304, the communication interface 1306, and the forwarding chip 1308 are communicatively connected to each other through the bus 1310. Figure 13The connection mode between the processor 1302, the memory 1304, the communication interface 1306 and the forwarding chip 1308 shown is only exemplary, and in the implementation process, the processor 1302, the memory 1304, the communication interface 1306 and the forwarding chip 1308 can also be connected in communication with each other in other connection modes other than the bus 1310.

[0203] The memory 1304 is configured to store a computer program 13042, which can include instructions and data. The memory 1304 can be various types of storage media, such as random access memory (RAM), read-only memory (ROM), non-volatile RAM (NVRAM), programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), flash memory, optical storage, and registers, etc.

[0204] The processor 1302 can be a general-purpose processor, which can be a processor that reads and executes a computer program (such as the computer program 13042) stored in a memory (such as the memory 1304) to perform specific steps and / or operations, and can use data stored in the memory (such as the memory 1304) in the process of executing the steps and / or operations. The general-purpose processor can be, for example but not limited to, a central processing unit (CPU). In addition, the processor 1302 can also be a special-purpose processor, which can be a processor specially designed to perform specific steps and / or operations. The special-purpose processor can be, for example but not limited to, an ASIC, an FPGA, or a GAL, etc.

[0205] The communication interface 1306 can include an input / output (I / O) interface, a physical interface, and a logical interface, etc. for realizing interconnection of devices inside the network device 1300, and for realizing interconnection of the network device 1300 with other devices. The physical interface can be a gigabit Ethernet (GE) interface, which can be used to realize interconnection of the network device 1300 with other devices, and the logical interface is an interface inside the network device 1300, which can be used to realize interconnection of devices inside the network device 1300. It is easy to understand that the communication interface 1306 can be used for the network device 1300 to communicate with other devices, for example, the communication interface 1306 is used for sending and receiving information between the network device 1300 and other devices.

[0206] The bus 1310 can be any type of communication bus for realizing interconnection of the processor 1302, the memory 1304, the communication interface 1306, and the forwarding chip 1308, such as a system bus.

[0207] The forwarding chip 1308 can be an ASIC chip, an FPGA chip, an NP chip, a GAL chip, etc. The interconnection of any device in the processor 1302, the memory 1304, and the communication interface 1306 and the forwarding chip 1308 can specifically refer to the interconnection of the any device and a device in the forwarding chip 1308. In some embodiments, the above-mentioned processor 1302, memory 1304, and communication interface 1306 can all be integrated on the forwarding chip 1308, or the above-mentioned processor 1302, memory 1304, and communication interface 1306 can be respectively arranged on chips independent of each other, and can also be at least partially or entirely arranged on the same chip. Whether to arrange each device independently on different chips or to integrate on one or more chips often depends on the needs of product design. The specific implementation form of the above-mentioned device is not limited in the present application.

[0208] Figure 13 The illustrated network device 1300 is only exemplary, and in the implementation process, the network device 1300 can also include other components, which are not listed one by one herein.

[0209] The embodiment of the present application provides a computer readable storage medium, the computer readable storage medium stores a computer program, when the computer program is executed (for example, executed by a network device, a forwarding chip, an ACL processing apparatus, etc.), all or part of the steps of the method provided by the above-mentioned method embodiment are realized.

[0210] The embodiment of the present application provides a computer program product, which comprises a program or code, and when the program or code is executed (for example, executed by a network device, a forwarding chip, an ACL processing apparatus, etc.), all or part of steps of the method provided by the above method embodiment are implemented.

[0211] In the above embodiments, all or part of the embodiments can be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments can be implemented in the form of a computer program product including one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer can be a general-purpose computer, a computer network or other programmable apparatus. The computer instructions can be stored in a computer readable storage medium of the computer, or transmitted from one computer readable storage medium to another, for example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center through wired (for example, coaxial cable, optical fiber, digital subscriber line) or wireless (for example, infrared, wireless, microwave, etc.) mode. The computer readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. integrated with one or more available media. The available media can be magnetic media (for example, floppy disk, hard disk, magnetic tape), optical media, or semiconductor media (for example, solid state disk) and the like.

[0212] It should be understood that the term "at least one" in the present application means one or more, and "multiple" means two or more. In the present application, unless otherwise specified, the symbol " / " generally represents the meaning of or, for example, A / B can represent A or B. The term "and / or" in the present application is only a description of the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B can represent three cases of A alone, A and B together, and B alone. In addition, in order to clearly describe, in the present application, the same items or similar items with basically the same function and role are distinguished by using "first", "second", "third" and the like. Those skilled in the art can understand that "first", "second", "third" and the like do not limit the quantity and execution order.

[0213] The method embodiments and device embodiments provided by the embodiments of the present application can be mutually referenced, and the embodiments of the present application do not limit this. The order of operation of the method embodiments provided by the embodiments of the present application can be adjusted appropriately, and the operation can also be increased or decreased in response to the situation. Any person skilled in the art can easily think of a method within the technical range disclosed by the present application, which should be covered within the protection scope of the present application, and therefore will not be described again.

[0214] In the corresponding embodiments provided by the present application, it should be understood that the disclosed devices and the like can be implemented by other configuration manners. For example, the device embodiments described above are only schematic, for example, the division of units is only a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the communication connection between the units shown or discussed can be indirect communication connection through some interface, device or unit, and can be electrical or other forms.

[0215] The units described as separate components can or can not be physically separate, and the components described as units can or can not be physical units, which can be located in one place or distributed on multiple network nodes. Part or all of the units can be selected to achieve the purpose of the embodiments of the present application according to actual needs.

[0216] The above is only an exemplary embodiment of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art can easily think of various equivalent modifications or replacements within the technical range disclosed by the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. An ACL processing device, characterized by, The ACL processing device applied to a forwarding chip comprises an obtaining unit, a constructing unit and a searching unit. The obtaining unit is configured to obtain a basic information set according to first message information, the first message information being information related to a first message, and the basic information set comprising at least one basic information related to the first message. The constructing unit is configured to construct first key information according to the basic information set, the first key information comprising at least one basic information in the basic information set. The searching unit is configured to search an access control list (ACL) rule library according to the first key information. The obtaining unit is further configured to extract fixed information of a first protocol layer from the first message information by using an application specific integrated circuit (ASIC), and extract flexible information from the first message information according to user configuration information, the basic information in the basic information set comprising the fixed information and the flexible information.

2. The ACL processing device of claim 1, wherein, The obtaining unit comprises a configurable extraction module and a first fixed extraction module, the first fixed extraction module being configured to extract the fixed information, and the configurable extraction module being configured to extract the flexible information.

3. The ACL processing device of claim 1, wherein, The obtaining unit is further configured to: extract target information of a first message type from the first message information, the first message type belonging to the first protocol layer; and determine the fixed information of the first protocol layer according to first type information and the target information, the first type information being used to indicate a message type of the first message corresponding to the first protocol layer.

4. The ACL processing device of claim 2, wherein, The first fixed extraction module is further configured to: extract target information of a first message type from the first message information, the first message type belonging to the first protocol layer; and determine the fixed information of the first protocol layer according to first type information and the target information, the first type information being used to indicate a message type of the first message corresponding to the first protocol layer.

5. The ACL processing device of claim 4, wherein, The first fixed extraction module comprises a first selection sub-module and at least one first fixed extraction sub-module, the at least one first fixed extraction sub-module corresponding to at least one first message type one by one, the at least one first message type belonging to the first protocol layer; each first fixed extraction sub-module in the at least one first fixed extraction sub-module is configured to extract target information of a first message type corresponding to the each first fixed extraction sub-module from the first message information; the first selection sub-module is configured to determine the fixed information of the first protocol layer according to the first type information and the target information extracted from the first message information by the at least one first fixed extraction sub-module.

6. The ACL processing device of any of claims 1-5, wherein, The obtaining unit is further configured to extract fixed information of a second protocol layer from the first message information, the basic information in the basic information set further comprising the fixed information of the second protocol layer.

7. The ACL processing device of any of claims 1-5, wherein, The obtaining unit comprises a second fixed extraction module, the second fixed extraction module being configured to extract fixed information of a second protocol layer from the first message information, the basic information in the basic information set further comprising the fixed information of the second protocol layer.

8. The ACL processing device of any of claims 1-5, wherein, The obtaining unit is further configured to: extract target information of a second packet type from the first packet information, the second packet type belonging to a second protocol layer; determine fixed information of the second protocol layer according to second type information and the target information of the second packet type, the second type information being used to indicate a packet type of the first packet corresponding to the second protocol layer.

9. The ACL processing device of claim 2, 4 or 5, wherein, The configurable extraction module includes a plurality of configurable extraction sub-modules, and bit widths of at least two configurable extraction sub-modules in the plurality of configurable extraction sub-modules are different; each configurable extraction sub-module in the plurality of configurable extraction sub-modules is configured to extract flexible information from the first packet information according to user configuration information and a bit width of the each configurable extraction sub-module, and the basic information set includes flexible information extracted from the first packet information by the plurality of configurable extraction sub-modules.

10. The ACL processing device of any of claims 1-5, wherein, Further comprising: an arbitration unit; The construction unit is further configured to construct second key information according to the basic information set, and the second key information includes at least one basic information in the basic information set. The lookup unit is further configured to look up the ACL rule library according to the second key information. The arbitration unit is configured to arbitrate first behavior information and second behavior information, the first behavior information being behavior information obtained by the lookup unit according to the first key information, and the second behavior information being behavior information obtained by the lookup unit according to the second key information.

11. The ACL processing device of claim 10, wherein, The first behavior information and the second behavior information respectively include fixed behavior information and flexible behavior information, and the arbitration unit is further configured to: arbitrate fixed behavior information included in the first behavior information and fixed behavior information included in the second behavior information; arbitrate flexible behavior information included in the first behavior information and flexible behavior information included in the second behavior information.

12. The ACL processing device of claim 11, wherein, The arbitration unit includes a fixed arbitration module and a configurable arbitration module; the fixed arbitration module is configured to arbitrate fixed behavior information included in the first behavior information and fixed behavior information included in the second behavior information; and the configurable arbitration module is configured to arbitrate flexible behavior information included in the first behavior information and flexible behavior information included in the second behavior information.

13. The ACL processing device of claim 10, wherein, Further comprising a decoding unit; The decoding unit is configured to normalize the first behavior information and the second behavior information; The arbitration unit is configured to arbitrate the normalized first behavior information and the normalized second behavior information.

14. The ACL processing device of claim 13, wherein, The decoding unit includes a first decoding module and a second decoding module; The first decoding module is configured to normalize the first behavior information; The second decoding module is configured to normalize the second behavior information.

15. The ACL processing device of claim 14, wherein, The first behavior information includes fixed behavior information and flexible behavior information, and the first decoding module includes a fixed decoding sub-module and a configurable decoding sub-module; The fixed decoding sub-module is configured to normalize fixed behavior information included in the first behavior information; The configurable decoding sub-module is configured to normalize flexible behavior information included in the first behavior information. The configurable decoding submodule is configured to normalize flexible behavior information included in the first behavior information. 16.The ACL processing apparatus of claim 10, wherein, The constructing unit is further configured to construct a plurality of key information according to the basic information set, the plurality of key information including the first key information and the second key information. The searching unit is further configured to search the ACL rule library according to the plurality of key information to obtain a plurality of target behavior information corresponding to the plurality of key information, the plurality of target behavior information including the first behavior information and the second behavior information. The arbitration unit is configured to arbitrate the plurality of target behavior information.

17. The ACL processing device of claim 16, wherein, The constructing unit includes a plurality of constructing modules, and the plurality of key information corresponds to the plurality of constructing modules one-to-one.

18. The ACL processing device of claim 10, wherein, The arbitration unit arbitrates the first behavior information and the second behavior information to obtain arbitration behavior information, and the ACL processing apparatus further includes an executing unit configured to execute an operation behavior indicated by the arbitration behavior information for the first packet. 19.The ACL processing apparatus of claim 2, 4 or 5, wherein, The first fixed extracting module includes an application specific integrated circuit (ASIC).

20. The ACL processing device of any of claims 1-5, 11-18, wherein, The first packet information includes one or more of the following: packet header information of the first packet, forwarding information of the first packet.

21. An ACL processing method, characterized by, including: obtaining a basic information set according to first packet information, the first packet information being information related to a first packet, the basic information set including at least one basic information related to the first packet; constructing first key information according to the basic information set, the first key information including at least one basic information in the basic information set; searching an access control list (ACL) rule library according to the first key information; wherein the obtaining the basic information set according to the first packet information includes: extracting fixed information of a first protocol layer from the first packet information by using an application specific integrated circuit (ASIC), and extracting flexible information from the first packet information according to user configuration information, the basic information in the basic information set including the fixed information and the flexible information. 22.The method of claim 21, wherein, the extracting the fixed information of the first protocol layer from the first packet information includes: extracting target information of a first packet type from the first packet information, the first packet type belonging to the first protocol layer; determining the fixed information of the first protocol layer according to first type information and the target information, the first type information being used to indicate a packet type of the first packet corresponding to the first protocol layer. 23.The method of claim 21, wherein, the obtaining the basic information set according to the first packet information further includes: extracting fixed information of a second protocol layer from the first packet information, the basic information in the basic information set further including the fixed information of the second protocol layer. 24.The method of claim 23, wherein, The extracting the fixed information of the second protocol layer from the first message information comprises: extracting target information of a second message type from the first message information, the second message type belonging to the second protocol layer; determining the fixed information of the second protocol layer according to second type information and the target information of the second message type, the second type information being used to indicate a message type of the first message corresponding to the second protocol layer.

25. The method of any one of claims 21-24, wherein, The method further comprises: constructing second key information according to the basic information set, the second key information comprising at least one basic information in the basic information set; searching the ACL rule library according to the second key information; arbitrating the first behavior information and the second behavior information, the first behavior information being behavior information obtained by searching the ACL rule library according to the first key information, the second behavior information being behavior information obtained by searching the ACL rule library according to the second key information.

26. The method of claim 25, wherein, The first behavior information and the second behavior information respectively comprise fixed behavior information and flexible behavior information. The arbitrating the first behavior information and the second behavior information comprises: arbitrating the fixed behavior information comprised in the first behavior information and the fixed behavior information comprised in the second behavior information; arbitrating the flexible behavior information comprised in the first behavior information and the flexible behavior information comprised in the second behavior information.

27. The method of claim 25, wherein: the method further comprises normalizing the first behavior information and the second behavior information; the arbitrating the first behavior information and the second behavior information comprises arbitrating the normalized first behavior information and the normalized second behavior information.

28. The method of claim 25, wherein: the constructing the first key information according to the basic information set comprises constructing a plurality of key information according to the basic information set, the plurality of key information comprising the first key information; the searching the ACL rule library according to the first key information comprises searching the ACL rule library according to the plurality of key information, obtaining a plurality of target behavior information corresponding to the plurality of key information, the plurality of target behavior information comprising the first behavior information and the second behavior information; the arbitrating the first behavior information and the second behavior information comprises arbitrating the plurality of target behavior information.

29. The method of claim 25, wherein, The arbitrating the first behavior information and the second behavior information obtains arbitrated behavior information, and the method further comprises: performing an operation behavior indicated by the arbitrated behavior information on the first message.

30. The method of any one of claims 21-24, 26-29, wherein, The first message information comprises one or more of the following: message header information of the first message, forwarding information of the first message.

31. A forwarding chip, comprising: The ACL processing apparatus comprises any one of claims 1-20.

32. The forwarding chip of claim 31, wherein: an architecture of the forwarding chip is a run-to-completion (RTC) architecture or a pipeline architecture.

33. The forwarding chip of claim 31 or 32, wherein, The architecture of the forwarding chip is a run-to-completion (RTC) architecture, the forwarding chip comprises a processor core and a ternary content-addressable memory (TCAM) array, the processor core comprises the obtaining unit, and the TCAM array comprises the constructing unit and the searching unit.

34. The forwarding chip of claim 31 or 32, wherein, The architecture of the forwarding chip is a pipeline architecture, and the forwarding chip comprises a plurality of processing nodes, at least one of the processing nodes comprising the ACL processing device.

35. A network device, comprising: The forwarding chip as claimed in any one of claims 31-34.

36. A computer readable storage medium, characterized in that, The computer program is stored in the computer readable storage medium and is executed to implement at least part of the steps of the method as claimed in any one of claims 21-30.

37. A computer program product, characterised in that, The computer program product comprises a program or code, which is executed to implement at least part of the steps of the method as claimed in any one of claims 21-30.

Images