Resolving conflicts between network service rule sets for network data traffic in a system where rule patterns with longer prefixes match before rule patterns with shorter prefixes

1. A method for facilitating high speed network packet flow by resolving conflicts between network service rules for network data traffic in a system where rule patterns with longer prefixes match before rule patterns with shorter prefixes, comprising:

receiving one or more flows of packets;

receiving a set of network service rules for network data traffic from multiple network services, wherein network service rules from different network services can possibly conflict;

wherein each of the network service rules specifies, a filter that defines a prefix for a set of packets in the packet flow, and an action list that specifies one or more actions to be applied to the set of packets;

identifying conflicts between higher priority rules and lower priority rules in the set of network service rules that are to be applied to packet flows;

constructing a consistent set of network service rules with modified action lists, wherein each action list is modified by prepending an action list of the higher priority rule to an action list of a rule with a filter that defines a longer prefix, wherein if the set of packets associated with the higher priority rule is equal to the set of packets associated with the lower priority rule, constructing the set of networking service rules involves creating a new action list for the higher priority rule by prepending the action list of the higher priority rule to the action list of the lower priority rule; and

applying the consistent set of rules to a switching mechanism to facilitate packet flow management.

2. The method of claim 1 , wherein if the set of packets associated with the higher priority rule is a superset of the set of packets associated with the lower priority rule, resolving the conflict involves creating a new action list for the lower priority rule by prepending the action list of the higher priority rule to the action list of the lower priority rule.

3. The method of claim 1 , wherein if the set of packets associated with the lower priority rule is a superset of the set of packets associated with the higher priority rule, resolving the conflict involves creating a new action list for the higher priority rule by prepending the action list of the higher priority rule to the action list of the lower priority rule.

4. The method of claim 1 , wherein if the set of packets associated with the lower priority rule intersects the set of packets associated with the higher priority rule, resolving the conflict involves:

creating a new rule with a filter that defines the intersection of the set of packets associated with lower priority rule and the set of packets associated with the higher priority rule; and

creating an action list for the new rule by prepending the action list of the higher priority rule to the action list of the lower priority rule.

5. The method of claim 1 , wherein prior to modifying a rule in the set of network service rules, the method further comprises cloning the rule to ensure that potential conflicts with rules that appear later in the set of network service rules are not overlooked.

6. The method of claim 1 , wherein the priority of a given rule is based upon one or more of the following:

a priority associated with a network service from which given rule originated;

a count of the number of prefix bits specified by the filter for the given rule; and

a time stamp indicating when the given rule was incorporated into the set of network service rules.

7. The method of claim 1 , wherein an action specified by a network service rule can include, but is not limited to:

dropping a packet;

gathering statistical information about the packet;

controlling timer functions associated with the packet;

modifying the packet; and

passing the packet on.

8. The method of claim 1 , wherein the multiple network services can include, but is not limited to:

a firewall service;

a service level agreement monitoring service;

a load balancing service;

a transport matching service;

a failover service; and

a high availability service.

9. A computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for resolving conflicts between network service rules for network data traffic in a system where rule patterns with longer prefixes match before rule patterns with shorter prefixes, the method comprising:

receiving one or more flows of packets;

receiving a set of network service rules for network data traffic from multiple network services, wherein network service rules from different network services can possibly conflict;

wherein each of the network service rules specifies, a filter that defines a prefix for a set of packets in the packet flow, and an action list that specifies one or more actions to be applied to the set of packets;

identifying conflicts between higher priority rules and lower priority rules in the set of network service rules that are to be applied to packet flows; and

constructing a consistent set of network service rules with modified action lists, wherein each action list is modified by prepending an action list of the higher priority rule to an action list of a rule with a filter that defines a longer prefix, wherein if the set of packets associated with the higher priority rule is equal to the set of packets associated with the lower priority rule, constructing the set of network service rules involves creating a new action list for the higher priority rule by prepending the action list of the higher priority rule to the action list of the lower priority rule.

10. The computer-readable storage medium of claim 9 , wherein if the set of packets associated with the higher priority rule is a superset of the set of packets associated with the lower priority rule, resolving the conflict involves creating a new action list for the lower priority rule by prepending the action list of the higher priority rule to the action list of the lower priority rule.

11. The computer-readable storage medium of claim 9 , wherein if the set of packets associated with the lower priority rule is a superset of the set of packets associated with the higher priority rule, resolving the conflict involves creating a new action list for the higher priority rule by prepending the action list of the higher priority rule to the action list of the lower priority rule.

12. The computer-readable storage medium of claim 9 , wherein if the set of packets associated with the lower priority rule intersects the set of packets associated with the higher priority rule, resolving the conflict involves:

creating a new rule with a filter that defines the intersection of the set of packets associated with lower priority rule and the set of packets associated with the higher priority rule; and

creating an action list for the new rule by prepending the action list of the higher priority rule to the action list of the lower priority rule.

13. The computer-readable storage medium of claim 9 , wherein prior to modifying a rule in the set of network service rules, the method further comprises cloning the rule to ensure that potential conflicts with rules that appear later in the set of network service rules are not overlooked.

14. The computer-readable storage medium of claim 9 , wherein the priority of a given rule is based upon one or more of the following:

a priority associated with a network service from which given rule originated;

a count of the number of prefix bits specified by the filter for the given rule; and

a time stamp indicating when the given rule was incorporated into the set of network service rules.

15. The computer-readable storage medium of claim 9 , wherein an action specified by a network service rule can include, but is not limited to:

dropping a packet;

gathering statistical information about the packet;

controlling timer functions associated with the packet;

modifying the packet; and

passing the packet on.

16. The computer-readable storage medium of claim 9 , wherein the multiple network services can include, but is not limited to:

a firewall service;

a service level agreement monitoring service;

a load balancing service;

a transport matching service;

a failover service; and

a high availability service.

17. An apparatus that resolves conflicts between network service rules for network data traffic in a system where rule patterns with longer prefixes match before rule patterns with shorter prefixes, comprising:

a receiving mechanism configured to receive one or more flows of packets;

a receiving mechanism configured to receive a set of network service rules for network data traffic from multiple network services, wherein network service rules from different network services can possibly conflict;

wherein each of the network service rules specifies, a filter that defines a prefix for a set of packets in the packet flow, and an action list that specifies one or more actions to be applied to the set of packets;

a conflict detection mechanism configured to identify conflicts between higher priority rules and lower priority rules in the set of network service rules that are to be applied to packet flows; and

a conflict resolution mechanism configured to resolve the conflict by constructing a consistent set of network service rules with modified action lists, wherein each action list is modified by prepending an action list of the higher priority rule to an action list of a rule with a filter that defines a longer prefix, wherein if the set of packets associated with the higher priority rule is equal to the set of packets associated with the lower priority rule, the conflict resolution mechanism is configured to:

create a new action list for the higher priority rule by prepending the action list of the higher priority rule to the action list of the lower priority rule; and to

delete the lower priority rule.

18. The apparatus of claim 17 , wherein if the set of packets associated with the higher priority rule is a superset of the set of packets associated with the lower priority rule, the conflict resolution mechanism is configured to create a new action list for the lower priority rule by prepending the action list of the higher priority rule to the action list of the lower priority rule.

19. The apparatus of claim 17 , wherein if the set of packets associated with the lower priority rule is a superset of the set of packets associated with the higher priority rule, the conflict resolution mechanism is configured to create a new action list for the higher priority rule by prepending the action list of the higher priority rule to the action list of the lower priority rule.

20. The apparatus of claim 17 , wherein if the set of packets associated with the lower priority rule intersects the set of packets associated with the higher priority rule, the conflict resolution mechanism is configured to:

create a new rule with a filter that defines the intersection of the set of packets associated with lower priority rule and the set of packets associated with the higher priority rule; and to

create an action list for the new rule by prepending the action list of the higher priority rule to the action list of the lower priority rule.

21. The apparatus of claim 17 , wherein prior to modifying a rule in the set of network service rules, the conflict resolution mechanism is configured to clone the rule to ensure that potential conflicts with rules that appear later in the set of network service rules are not overlooked.

22. The apparatus of claim 17 , wherein the priority of a given rule is based upon one or more of the following:

a priority associated with a network service from which given rule originated;

a count of the number of prefix bits specified by the filter for the given rule; and

a time stamp indicating when the given rule was incorporated into the set of network service rules.

23. The apparatus of claim 17 , wherein an action specified by a network service rule can include, but is not limited to:

dropping a packet;

gathering statistical information about the packet;

controlling timer functions associated with the packet;

modifying the packet; and

passing the packet on.

24. The apparatus of claim 17 , wherein the multiple network services can include, but is not limited to:

a firewall service;

a service level agreement monitoring service;

a load balancing service;

a transport matching service;

a failover service; and

a high availability service.