A method and network device for storing and matching ACL entries

Abstract

The specification provides a method for storing an ACL table item and matching the ACL table item and a network device, wherein the method for storing the ACL table item comprises the following steps: obtaining an ACL table item to be stored, splitting the ACL table item into a first part and a second part, the first part comprising a source address and a destination address of the ACL table item, the second part comprising part or all of information of Srcport, Dstport, Ip protocol, Next Header, Dscp and Port of the ACL table item, storing the first part in a TCAM memory, and storing the second part in an SRAM memory. Through the method, the specification of the ACL feature of the network device can be effectively improved.

Description

TECHNICAL FIELD

[0001] The present specification relates to the technical field of communication, and particularly relates to a method for storing and matching ACL table entries and a network device. BACKGROUND

[0002] ACL: Access Control List, a set of rules used to identify message flow. The rule here refers to a judgment statement describing the message matching condition, and the matching condition can be the source address, destination address, port number, etc. of the message. The device identifies specific messages according to the ACL rule and processes them according to the pre-set policy. The most common application is to use ACL for message filtering. In addition, ACL can also be applied to identify messages in services such as routing, security, QoS, etc. The specific processing method of these messages is determined by the service module that applies ACL.

[0003] TCAM: Ternary Content Addressable Memory, a ternary content addressable memory. As an extended storage resource of the device, it is often used to store ARP, ACL, routing and other service table entries. By configuring the running mode of TCAM, the storage space allocated by TCAM to each service table entry can be adjusted to meet the needs of service running.

[0004] SRAM: Static Random Access Memory, a type of static random access memory that stores data in word form and requires an address to access and manipulate data. SRAM chips can be embedded in network devices such as routers, switches, etc. for storing and executing access control policies. In this way, the device can quickly and accurately process incoming and outgoing data packets according to predefined rules. By using SRAM, ACL services can achieve fast packet filtering and access control, improving network security and performance.

[0005] HASH: Hash Function is a function that generates a fixed-length hash value by calculating and transforming data of any length, which is used to uniquely represent the input data. It has the characteristics of determinism, irreversibility, efficiency and dispersion, and is widely used in cryptography, data integrity verification, content addressing, data uniqueness verification and other fields. HASH algorithm can quickly process a large amount of data and provide unique identification and fast lookup function of data, which is an indispensable important technology in information security and data management.

[0006] When processing data packets, network devices (such as switches, routers, etc.) usually use access control lists (ACLs) to control the flow of data packets. ACLs filter and match incoming and outgoing data packets according to predetermined rules to achieve security and network management purposes. However, as the size of the network and data traffic continues to increase, the rule set of traditional ACLs becomes increasingly large, leading to performance degradation and configuration difficulties. SUMMARY

[0007] To overcome the problems in the related art, the present specification provides a method for storing and matching ACL table entries and a network device.

[0008] According to a first aspect of an embodiment of the present specification, a method for storing an ACL table entry is provided, the method comprising:

[0009] obtaining an ACL table entry to be stored, and splitting the ACL table entry into a first part and a second part;

[0010] The first part includes the source address and the destination address of the ACL table entry, and the second part includes part or all of the information of Srcport, Dstport, Ip protocol, Next Header, Dscp, and Port in the ACL table entry;

[0011] storing the first part in a TCAM memory and storing the second part in an SRAM memory.

[0012] The storing of the first part in the TCAM memory and the storing of the second part in the SRAM memory comprises:

[0013] storing the first part in the TCAM memory and assigning a first identifier;

[0014] storing the second part in the SRAM memory and assigning a second identifier;

[0015] The first identifier uniquely corresponds to the second identifier.

[0016] The first part further includes one of the source interface, the destination interface, the IP protocol, the service code point, and the Next Header in the ACL table entry, and the second part includes the information in the ACL table entry other than the first part.

[0017] As can be seen from the above embodiments, by splitting the ACL table entry into two parts, one part is stored in the TCAM memory and the other part is stored in the SRAM memory, the specification of the ACL feature of the network device can be effectively improved.

[0018] According to a second aspect of the embodiments of the present specification, a method for matching ACL entries is provided, which comprises:

[0019] receiving a first packet, and obtaining source IP and destination IP information of the first packet;

[0020] matching the source IP and destination IP information of the first packet with a first part of each ACL entry stored in a TCAM memory, and obtaining a first identifier according to a matching result;

[0021] matching part or all of the information of Srcport, Dstport, Ip protocol, Next Header, Dscp, and Port of the first packet with a second part of each ACL entry stored in a SRAM memory according to the first identifier, and obtaining a matching result;

[0022] processing the first packet according to the matching result;

[0023] The first part comprises a corresponding relationship between the source IP and destination IP information of each ACL entry and the first identifier, and the second part comprises a corresponding relationship between part or all of the information of Srcport, Dstport, Ip protocol, Next Header, Dscp, and Port of each ACL entry and the second identifier, wherein each first identifier uniquely corresponds to each second identifier.

[0024] The matching part or all of the information of Srcport, Dstport, Ip protocol, Next Header, Dscp, and Port of the first packet with the second part of each ACL entry stored in the SRAM memory according to the first identifier to obtain the matching result comprises:

[0025] combining part or all of the information of Srcport, Dstport, Ip protocol, Next Header, Dscp, and Port of the first packet with the first identifier, and obtaining a hash value through hash calculation;

[0026] determining a target second part region stored in the SRAM according to the hash value and the first identifier;

[0027] matching part or all of the information of Srcport, Dstport, Ip protocol, Next Header, Dscp, and Port of the first packet with the target second part region, and obtaining a matching result.

[0028] The first part further includes one of a source interface, a destination interface, an IP protocol, a service code point, and a Next Header in the ACL entry; and the second part includes information in the ACL entry other than the first part.

[0029] The processing the first packet according to the matching result includes:

[0030] Discarding or passing the first packet according to the matching result.

[0031] It can be seen from the above embodiments that, based on the ACL entries being split and stored in different memories, the ACL processing of the packet can be completed.

[0032] According to a third aspect of the embodiments of the present specification, the embodiments of the present disclosure further provide a network device configured with a TCAM memory and a SRAM memory, the network device comprising:

[0033] An obtaining module is configured to obtain an ACL entry to be stored, and split the ACL entry into a first part and a second part, wherein the first part includes a source address and a destination address of the ACL entry, and the second part includes part or all of information of Srcport, Dstport, Ip protocol, Next Header, Dscp, and Port of the ACL entry;

[0034] A processing module is configured to store the first part in the TCAM memory and store the second part in the SRAM memory.

[0035] According to a fourth aspect of the embodiments of the present specification, the embodiments of the present disclosure further provide a network device, the network device comprising:

[0036] A receiving module is configured to receive a first packet, and obtain source IP and destination IP information of the first packet;

[0037] A matching module is configured to match the source IP and the destination IP information of the first packet with the first part of each ACL entry stored in the TCAM memory, and obtain a first identifier according to a matching result;

[0038] The matching module is further configured to match the first identifier and part or all of information of Srcport, Dstport, Ipprotocol, Next Header, Dscp, and Port of the first packet with the second part of each ACL entry stored in the SRAM memory to obtain a matching result;

[0039] A processing module is configured to process the first packet according to the matching result.

[0040] The first part includes a corresponding relationship between source IP and destination IP information of each ACL table item and a first identifier, and the second part includes a corresponding relationship between part or all of Srcport, Dstport, Ip protocol, Next Header, Dscp, and Port of each ACL table item and a second identifier, wherein each first identifier uniquely corresponds to each second identifier.

[0041] The matching module is specifically configured to combine part or all of Srcport, Dstport, Ip protocol, Next Header, Dscp, and Port of the first packet with the first identifier, and obtain a hash value through hash calculation.

[0042] The hash value and the first identifier are used to determine a target second part region stored in the SRAM.

[0043] Part or all of Srcport, Dstport, Ip protocol, Next Header, Dscp, and Port of the first packet are matched with the target second part region to obtain a matching result.

[0044] It should be understood that the foregoing general description and the following detailed description are only exemplary and explanatory, and cannot limit the present specification. BRIEF DESCRIPTION OF DRAWINGS

[0045] The accompanying drawings incorporated in the specification and constituting a part of the specification illustrate embodiments consistent with the present specification and, together with the specification, serve to explain the principles of the present specification.

[0046] Figure 1 is a logic diagram of a TCAM scheme according to an exemplary embodiment of the present specification.

[0047] Figure 2 is a logic diagram of an SRAM scheme according to an exemplary embodiment of the present specification.

[0048] Figure 3 is a flow diagram of a method for storing ACL table items according to an exemplary embodiment of the present specification.

[0049] Figure 4 is a flow diagram of a method for matching ACL table items according to an exemplary embodiment of the present specification. DETAILED DESCRIPTION

[0050] The exemplary embodiments will be described in detail herein with reference to the attached drawings. The description herein relates to the drawings, in which the same numbers represent the same or similar elements, throughout several figures. The following exemplary embodiments are described in order to provide a thorough understanding into the present description. It is understood that no single embodiment is representative of all of the aspects of the present description. Rather, they are merely examples of apparatus and methods in accordance with some aspects of the present description as detailed in the appended claims.

[0051] The terminology used in this description is for the purpose of describing particular embodiments only and is not intended to limit the present description. As used in this description and the appended claims, the singular forms "a," "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will also be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

[0052] It will be understood that, although the terms first, second, third, etc. can be used herein to describe various information, these terms are not intended to denote a temporal or chronological order. Rather, these terms are used only to distinguish different sets of information from one another. For example, a first information can be termed a second information, and similarly, a second information can also be termed a first information, without departing from the scope of the present description. As used herein, the word "if' can be construed to mean "when" or "in response to determining" depending on the context.

[0053] Currently, in one implementation, as shown in Figure 1 TCAM scheme, ACL rules are stored in TCAM, with high-speed matching and parallel comparison of TCAM, fast packet filtering and classification can be achieved. For example, compression algorithm compresses and stores ACL rules in TCAM, hierarchical storage divides ACL rules into multiple levels and stores them in different TCAM chips.

[0054] In this example, there are the following problems:

[0055] 1. Capacity limit: The capacity of TCAM is usually relatively small, which cannot accommodate large-scale ACL rule sets. Especially with the growth of network size and the improvement of ACL rule complexity, the capacity of TCAM can soon reach the upper limit.

[0056] 2. Expensive: The price of TCAM chip is relatively high, which limits its use in large-scale ACL devices. Deploying large-scale TCAM devices can require significant investment costs.

[0057] 3. Static configuration difficulty: Due to the limited capacity of TCAM and the inability to dynamically update rules, it is necessary to statically configure rules in advance. This brings difficulties in configuration management, especially in large-scale and complex network environments.

[0058] 4. Limited scalability: Due to the limited capacity and high price of TCAM, it is difficult to quickly expand and upgrade the device. In the case of increasing the number of ACL rules or adapting to network growth, the entire device may need to be replaced or upgraded, increasing maintenance costs and complexity.

[0059] In another example, as shown in Figure 2 , the ACL rules are stored in the SRAM table through the HASH algorithm, and the HASH table is used to quickly find and match the data packet. Smaller memory capacity can be used to store more ACL rules.

[0060] In this example, although the capacity of the SRAM table can be expanded to some extent according to the needs, it can better adapt to the storage needs of large-scale ACL rule sets, but there are still the following problems:

[0061] 1. Conflict problem: In the SRAM table, different ACL rules may map to the same HASH value, causing conflicts. When conflicts occur, additional operations are needed to resolve conflicts, which may introduce additional delay and overhead.

[0062] 2. Search performance: Although the SRAM table has the feature of fast search, with the increase of the number of ACL rules, the search performance of the SRAM table may decrease. Especially in the case of many conflicts, the search speed may slow down significantly.

[0063] 3. Update difficulty: Compared with the TCAM-based implementation scheme, the ACL rules in the SRAM table can be dynamically updated. However, updating the rules in the SRAM table may involve rebuilding or adjusting the entire SRAM table, which may introduce high overhead and delay.

[0064] 4. Hardware overhead: In order to support high-performance SRAM table implementation, more complex hardware structures and algorithms may be needed, which may increase the complexity and hardware overhead of implementation.

[0065] To solve the above technical problems, the embodiments of the present disclosure provide a method for storing ACL table entries, as shown in Figure 3 , the method comprises:

[0066] S301 obtains the ACL table entry to be stored, and splits the ACL table entry into a first part and a second part;

[0067] The first part includes source address and destination address of the ACL entry, and the second part includes part or all of information of Srcport (source port), Dstport (destination port), Ip protocol (protocol), Next Header (next hop header field), Dscp (differentiated service code point), and Port (logical end point) of the ACL entry.

[0068] S302 stores the first part in the TCAM memory and stores the second part in the SRAM memory.

[0069] In the embodiment, the ACL entry is split into the first part and the second part, and each split ACL entry is stored in association by introducing the first identifier (such as acl_cascade_key) and the second identifier (such as acl_cascade_action).

[0070] In the embodiment, when configuring the ACL related service, such as when the operator network device configures the ACL related service, the protocol stack of IPv4 and IPv6 may be involved, as shown in Table 1, which lists the ACL matching fields involved in the two protocol stacks of IPv4 and IPv6.

[0071]

[0072] Table 1

[0073] As can be seen from the above table, the IPv4 protocol stack needs to occupy 122 bits of resources when performing ACL full matching, and the IPv6 protocol stack needs to occupy 314 bits of resources when performing ACL full matching.

[0074] In the embodiment, in order to save the resources of the network device for storing the ACL entry, the ACL entry is split into the first part and the second part, and the first part and the second part are stored in different memories.

[0075] As shown in Table 1, in the IPv4 protocol stack, the source address and the destination address (SrcIp and DstIp) two parameters may exist in the case of mask address (address network segment) when performing ACL matching. Similarly, in the IPv6 protocol stack, the source address and the destination address (SrcIpv6 and DstIpv6) two parameters may exist in the case of mask address (address network segment) when performing ACL matching, so the SrcIp and DstIp or SrcIpv6 and DstIpv6 which may exist in the case of mask address parameter are taken as the first part of the split ACL entry and stored in the TCAM memory to realize subsequent flexible matching.

[0076] The other matching items (L4 Srcport, L4 Dstport, Ip protocol, Dscp, Port) for ACL matching of IPv4 and the other matching items (L4 Srcport, L4 Dstport, Next Header, Dscp, Port) for ACL matching of IPv6 need to be matched completely, so the other matching items (L4 Srcport, L4 Dstport, Ip protocol, Dscp, Port, or L4 Srcport, L4 Dstport, Next Header, Dscp, Port) can be stored in the SRAM memory as the second part of the split ACL table entry.

[0077] In the embodiment, when the second part of the ACL table entry is stored in the SRAM memory, the second part can be operated by HASH, and the second part of the ACL table entry is stored in the SRAM memory according to the operation result.

[0078] In an embodiment, as shown in Table 2, since the TCAM memory supports the storage of 80-160 bit entries, when the stored parameters are less than 80 bits, invalid bits are automatically supplemented, and in general, in IPv4, the source address (SrcIp) and the destination address (DstIp) occupy 64 bits, so any one of the source interface, the destination interface, the IP protocol, and the service code point can be stored in the TCAM memory to improve the utilization of the TCAM memory and avoid waste of resources.

[0079]

[0080] Table 2

[0081] Similarly, as shown in Table 3, in IPv6, the source address (SrcIp) and the destination address (DstIp) occupy 128 bits,

[0082]

[0083] Table 3

[0084] Therefore, any one of the source interface, the destination interface, the Next Header, and the service code point can be stored in the TCAM memory to improve the utilization of the TCAM memory resources.

[0085] In the embodiment, after storing the first part of the ACL entry into the TCAM memory, a first identifier is assigned, such as Cascade Action in Table 2 or Table 3, and after storing the second part into the SRAM memory, a second identifier is assigned, such as Cascade Key in Table 2 or Table 3. The first identifier and the second identifier uniquely correspond to each other.

[0086] In an example, assuming there are three ACL entries ACL1, ACL2 and ACL3, which are stored according to the method in the above embodiments, as shown in Table 4:

[0087]

[0088]

[0089] Table 4

[0090] In Table 4, ACL1, ACL2 and ACL3 are respectively split into a first part and a second part, the first part of ACL1, ACL2 and ACL3 is stored in the TCAM memory, i.e., the content in ACL1 TCAM, ACL2 TCAM and ACL3 TCAM in Table 4, and the second part of ACL1, ACL2 and ACL3 is stored in the SRAM memory, i.e., the content in ACL1 SRAM, ACL2 SRAM and ACL3 SRAM in Table 4.

[0091] The first identifier Cascade Action1, Cascade Action1 and Cascade Action3 is respectively assigned to ACL1 TCAM, ACL2 TCAM and ACL3 TCAM, and the second identifier Cascade Key1, Cascade Key1 and Cascade Key3 is respectively assigned to ACL1 SRAM, ACL2 SRAM and ACL3 SRAM. It can be seen that the first identifiers of ACL1 TCAM and ACL2 TCAM are the same, and since the first identifier uniquely corresponds to the second identifier, the second identifiers of ACL1 SRAM and ACL2 SRAM are both Cascade Key1.

[0092] In an example, if the rule information issued in the TCAM is the same, then the two ACLs are assigned to the same Cascade Key, and only one split ACL needs to be issued in the TCAM resource, while the ACL issued in the SRAM still needs to be issued as two split ACL rules due to the different corresponding rule information.

[0093] It should be noted that in the present embodiment, the network device applies the ACL feature in the inbound direction of the interface and also applies the ACL feature in the outbound direction of the interface when configuring the ACL feature. The ACLs in the inbound direction and the outbound direction are both applicable to the technology in the present disclosure.

[0094] As can be seen from the above embodiments, when storing the ACL table entries, the ACL table entries are split and respectively exist in the TCAM memory and the SRAM memory, which can effectively improve the specification of the ACL feature of the network device. Theoretically, the specification is improved by 200%-300% on the basis of the original specification, and the redundancy of the ACL feature is reduced by 50%-100%.

[0095] For example, in a set of test results, the environmental background is a network device of an operator, and the TCAM resource is: 12*1024*160bit=12288*160bit,

[0096] wherein 12 represents a total of 12 Bank resources that can be accessed in parallel,

[0097] 1024 represents that there is an Entry resource that needs to be accessed in series in each Bank,

[0098] 160bit represents that each Entry resource can store an ACL with a maximum bit width of 160bit,

[0099] wherein the TCAM resource is: 12*1024*160bit=12288*160bit

[0100] When the device applies the ACL under an interface, and the Inbound and Outbound directions simultaneously apply the same ACL rules, the same specification of IPv4 and IPv6 ACLs.

[0101] 1. When using the TCAM resource alone: one IPv4 ACL needs to occupy 1*160bit, and the Inbound and Outbound need to occupy 2*160bit simultaneously; one IPv6 ACL needs to occupy 1*320bit, and the Inbound and Outbound need to occupy 2*320bit=4*160bit simultaneously. The final device can support 2048 IPv4 ACLs and 2048 IPv4 ACLs. Parallel and high-performance searching can be met.

[0102] 2. When using the SRAM resource alone: it cannot meet the requirements and can only support IPv4 ACLs, and cannot issue IPv6 ACLs.

[0103] 3. When using TCAM and SRAM resource fusion: one IPv4 ACL needs to occupy 1*80bit of TCAM resource, 2*60bit of SRAM resource; one IPv6 ACL needs to occupy 1*160bit of TCAM resource, 2*60bit of SRAM resource. Limited by the specification of TCAM resource, the final device can support the ACL specification of 8192 IPv4 ACLs and 8192 IPv6 ACLs. Parallel and high-performance lookup can be met.

[0104] It can be seen from the test results that the ACL specification of the operator network device is improved by 300%, and the redundancy of the ACL characteristics is reduced by 50% (here, if the ACL is split and issued in the TCAM part, the redundancy can be further reduced when each ACL is completely different).

[0105] Based on the above method embodiments, the embodiment of the present disclosure further provides a method for matching ACL table items, as shown in Figure 4 The method comprises the following steps:

[0106] S401 receives a first packet and obtains source IP and destination IP information of the first packet;

[0107] S402 matches the source IP and destination IP information of the first packet with the first part of each ACL table item stored in the TCAM memory, and obtains a first identifier according to the matching result;

[0108] S403 matches part or all of the information of Srcport, Dstport, Ip protocol, Next Header, Dscp and Port in the first identifier and the first packet with the second part of each ACL table item stored in the SRAM memory to obtain a matching result;

[0109] S404 processes the first packet according to the matching result;

[0110] The first part includes the correspondence between the source IP and destination IP information of each ACL table item and the first identifier, and the second part includes the correspondence between part or all of the information of Srcport, Dstport, Ip protocol, Next Header, Dscp and Port in each ACL table item and the second identifier, wherein each first identifier uniquely corresponds to each second identifier.

[0111] In step S401, when the network device receives the first packet, the ACL policy of the first packet can be determined by two times of matching, wherein when the network device receives the first packet, the content used for matching with the TCAM memory is selected first.

[0112] For example, the first part stored in the TCAM memory includes source IP and destination IP information, and the source IP and destination IP information carried in the first packet is obtained. In other embodiments, if the first part stored in the TCAM memory includes source IP, destination IP information and Srcport, the source IP, destination IP and Srcport information carried in the first packet is obtained.

[0113] In this embodiment, the source IP and destination IP information obtained from the first packet is matched with the first part of each ACL table item stored in the TCAM memory. As shown in Table 4, it is assumed that the matching determines that the ACL1 TCAM is matched, and the first identification Cascade Action1 is obtained.

[0114] After the Cascade Action1 is obtained, the Cascade Action1 is superimposed with other information in the first packet except the source IP and destination IP information, and the superimposed content is matched with the content in the SRAM memory.

[0115] In one embodiment, the superimposed content can be matched with all the content in the SRAM memory one by one, and in another embodiment, the superimposed content can be matched with the content corresponding to the Cascade Action1 in the SRAM memory. In this way, the range of the SRAM memory used for matching the superimposed content can be reduced, thereby saving the computing resources of the network device and improving the matching speed.

[0116] In the matching of the other information in the first packet except the source IP and destination IP information with the SRAM memory, the other information in the first packet except the source IP and destination IP information and the Cascade Action (the first identification) can be first calculated to obtain a hash value through a hash calculation, and the hash value and the first identification are used to determine the target second part region stored in the SRAM. In this step, the second part can be stored by using the hash value and the second identification as indexes. For example, in the SRAM memory, the same hash value can correspond to multiple second part contents, and the part corresponding to the second identification in the SRAM memory is determined through the first identification, and the target second part region is determined from the part corresponding to the second identification through the hash value (in other embodiments, the part corresponding to the first packet hash value in the SRAM can be first determined, and the target second part region is determined according to the second identification corresponding to the first identification). Part or all of the Srcport, Dstport, Ip protocol, NextHeader, Dscp and Port information of the first packet is matched with the target second part region to obtain a matching result.

[0117] In step S404, the first packet is processed according to the matching result, including discarding the first packet or processing the first packet according to the matching result.

[0118] As can be seen from the above embodiments, after the ACL is split and issued, the matching is performed from the TCAM resource in the Ingress ACL-1 stage, and the matching is performed from the SRAM resource in the Ingress ACL-2 / Egress ACL stage, so that the specification of the ACL feature of the operator network device can be significantly improved, which can generally be improved by 200%-300% on the basis of the original specification, and the ACL feature redundancy is reduced by 50%-100%.

[0119] Based on the above embodiments, the embodiments of the present disclosure further provide a network device, the network device being configured with a TCAM memory and a SRAM memory, and the network device comprising:

[0120] an obtaining module, configured to obtain an ACL entry to be stored, and split the ACL entry into a first part and a second part, wherein the first part comprises a source address and a destination address of the ACL entry, and the second part comprises part or all of information of Srcport, Dstport, Ip protocol, Next Header, Dscp, and Port of the ACL entry;

[0121] a processing module, configured to store the first part in the TCAM memory, and store the second part in the SRAM memory.

[0122] Based on the above embodiments, the embodiments of the present disclosure further provide a network device, the network device comprising:

[0123] a receiving module, configured to receive a first packet, and obtain source IP and destination IP information of the first packet;

[0124] a matching module, configured to match the source IP and the destination IP information of the first packet with the first part of each ACL entry stored in the TCAM memory, and obtain a first identifier according to a matching result;

[0125] The matching module is further configured to match the first identifier and part or all of information of Srcport, Dstport, Ipprotocol, Next Header, Dscp, and Port of the first packet with the second part of each ACL entry stored in the SRAM memory to obtain a matching result;

[0126] a processing module, configured to process the first packet according to the matching result;

[0127] The first part includes a corresponding relationship between source IP and destination IP information of each ACL entry and a first identifier, and the second part includes a corresponding relationship between part or all of information of Srcport, Dstport, Ip protocol, Next Header, Dscp and Port of each ACL entry and a second identifier, wherein each first identifier uniquely corresponds to each second identifier.

[0128] The matching module is specifically configured to combine part or all of information of Srcport, Dstport, Ip protocol, Next Header, Dscp and Port of the first packet with the first identifier, and obtain a hash value through hash calculation.

[0129] The hash value and the first identifier are used to determine a target second-part region stored in the SRAM.

[0130] Part or all of information of Srcport, Dstport, Ip protocol, Next Header, Dscp and Port of the first packet is matched with the target second-part region to obtain a matching result.

[0131] For the device embodiment, since it basically corresponds to the method embodiment, the related parts can be referred to the part of the method embodiment. The device embodiments described above are only illustrative, wherein the modules described as separate components can or can not be physically separated, and the components displayed as modules can or can not be physical modules, that is, they can be located in one place or distributed on multiple network modules. According to actual needs, some or all of the modules can be selected to achieve the purpose of the scheme of the present specification. Those skilled in the art can understand and implement without creative labor.

[0132] The above describes specific embodiments of the present specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be executed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multi-task processing and parallel processing are possible or can be advantageous.

[0133] Other embodiments of the present description will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. It is intended that the description be considered as exemplary only and the true scope and spirit of the present description being indicated by the following claims.

[0134] It is to be understood that the present description is not limited to the precise details of apparatus and methodology described herein and as illustrated in the drawings. Various modifications and changes in the precise operations and implementations can be made without departing from the scope of the present description. The scope of the present description is indicated by the appended claims rather than by the embodiments set forth in the description.

[0135] The above description is intended to be illustrative and not restrictive. Many other modifications within the scope of the described application will be readily apparent to those skilled in the art, and the scope of the application should not be limited to the exact details shown and described herein.

Claims

1. A method of matching ACL entries, characterized by, The method comprises: receiving a first packet, and obtaining source IP and destination IP information of the first packet; matching the source IP and the destination IP information of the first packet with a first part of each ACL table item stored in a TCAM memory, and obtaining a first identifier according to a matching result; matching part or all of information of Srcport, Dstport, Ip protocol, Next Header, Dscp and Port of the first packet with a second part of each ACL table item stored in an SRAM memory according to the first identifier, and obtaining a matching result; processing the first packet according to the matching result; the first part comprises a corresponding relationship between the source IP and the destination IP information of each ACL table item and the first identifier, and the second part comprises a corresponding relationship between part or all of information of Srcport, Dstport, Ip protocol, Next Header, Dscp and Port of each ACL table item and the second identifier, wherein each first identifier uniquely corresponds to each second identifier; the matching part or all of information of Srcport, Dstport, Ip protocol, Next Header, Dscp and Port of the first packet with the second part of each ACL table item stored in the SRAM memory according to the first identifier to obtain the matching result comprises: combining part or all of information of Srcport, Dstport, Ip protocol, Next Header, Dscp and Port of the first packet with the first identifier, and obtaining a hash value through hash calculation; determining a target second part region stored in the SRAM according to the hash value and the first identifier; matching part or all of information of Srcport, Dstport, Ip protocol, Next Header, Dscp and Port of the first packet with the target second part region to obtain a matching result.

2. The method of claim 1, wherein, The first part further comprises one of a source interface, a destination interface, an IP protocol, a service code point and a Next Header in the ACL table item, and the second part comprises information in the ACL table item except the first part.

3. The method of claim 1, wherein, The processing of the first packet according to the matching result comprises: discarding or passing the first packet according to the matching result.

4. A network device, comprising: The network device comprises: a receiving module configured to receive a first packet, and obtain source IP and destination IP information of the first packet; a matching module configured to match the source IP and the destination IP information of the first packet with a first part of each ACL table item stored in a TCAM memory, and obtain a first identifier according to a matching result; The matching module is further configured to match part or all of information of the first identifier and Srcport, Dstport, Ip protocol, Next Header, Dscp, and Port of the first packet with the second part of each ACL table item stored in the SRAM memory to obtain a matching result; a processing module configured to process the first packet according to the matching result; wherein the first part includes a corresponding relationship between source IP and destination IP information of each ACL table item and the first identifier, and the second part includes a corresponding relationship between part or all of information of Srcport, Dstport, Ip protocol, Next Header, Dscp, and Port of each ACL table item and the second identifier, wherein each first identifier uniquely corresponds to each second identifier; the matching module is specifically configured to combine part or all of information of Srcport, Dstport, Ip protocol, Next Header, Dscp, and Port of the first packet with the first identifier, and obtain a hash value through hash calculation; determine a target second part region stored in the SRAM by using the hash value and the first identifier; match part or all of information of Srcport, Dstport, Ip protocol, Next Header, Dscp, and Port of the first packet with the target second part region to obtain a matching result.

Images