Method and apparatus for implementing filter rules in a network element
View Patent ↗Multiple non-conflicting actions associated with filter rules may be located and applied to a packet using a single ACL lookup by causing action records to be created from ACEs in the ACL, and then causing the ACL lookup to return the action record rather than any one particular ACE. Radix tables may be created to enable a search engine to quickly locate the appropriate action record based on a particular set of attributes associated with the incoming packet. The action record can contain multiple actions taken from multiple ACEs that apply to the particular packet. By grouping all the actions into an action record, and then searching for an action record that applies to the packet, it is possible to apply all non-conflicting actions to the packet regardless of the number of ACEs that are used to specify those actions. Since all the actions are located together, the actions of all ACEs may be applied to a packet using a single ACL lookup.
1. A network element, comprising:
a microprocessor; and
a computer readable memory containing program instructions for execution on the microprocessor, the program instructions including:
first program logic configured to enable a set of ACEs in at least one ACL to be condensed to a set of action records, at least some of said action records containing multiple actions specified by different ACEs that commonly apply to packets having particular attribute values; and
second programmable logic configured to enable the action records to be found in connection with performing filter operations on packets received by the network element to enable all actions specified by the action records to be applied to the packets;
wherein each of the at least some of said action records containing a non-conflicting set of different actions associated with a plurality of filter rules that commonly apply to packets having the particular attribute values to enable all actions specified by the action records to be applied to the packets.
2. The network element of claim 1 , wherein the action records are configured to contain actions from both port-based and VLAN based ACLs.
3. The network element of claim 1 , wherein the actions contained in the action records are sorted according to precedence of an associated ACE.
4. The network element of claim 1 , comprising:
wherein the action records contain sets of non-conflicting actions derived from ACEs that apply to packets with the packets having the particular attribute values.
5. The network element of claim 1 , wherein the first programmable logic is configured to sort the ACEs into lookup tables to determine the sets of ACEs, and wherein the second programmable logic is configured to enable the action records to be found in connection with performing filter operations by causing the lookup tables to be programmed into a fastpath of the network element to be used in connection with performing filter operations.
6. A method for implementing filter rules in a network element, the method comprising the steps of:
processing, by the network element, a set of ACEs associated with an ACL to generate a set of action records, at least some of said action records containing a non-conflicting sets of different actions associated with pluralities of filter rules that commonly apply to packets having particular attribute values to enable all actions specified by the action records to be applied to the packets; and
processing, by the network element, a set of ACEs associated with an ACL to generate a set of lookup tables for attributes specified in the ACEs, said lookup tables pointing to said action records, and being configured to enable a filtering operation to identify an action record based on attribute values of a packet so that all actions specified by the action records may be applied to the packets;
wherein only non-conflicting actions are included in the lists.
7. The method of claim 6 , wherein the step of processing the set of ACEs to generate a set of action records is implemented using radix tables.
8. The method of claim 7 , further comprising the step of programming the radix tables and action records into a data path for use in connection with the filtering operation.
9. The method of claim 6 , wherein the lookup tables are radix tables.
10. The method of claim 6 , wherein the action records contain lists of actions to be applied to packets having particular attribute values, said lists of actions being derived from actions specified by the groups of ACEs for packets having particular attribute values.
11. The method of claim 10 , wherein the actions in the lists are applied according to a precedence.
12. A method of applying a set of filters to a packet on a network element, the method comprising the steps of:
obtaining, by the network element, a packet having packet attribute values;
using, by the network element, a first of said packet attribute values as a key to a first search that is to be performed in a first attribute lookup table; and
obtaining, by the network element, as a result of the first search, at least one of a lookup failure, a lookup success, and a next attribute indication, wherein when a lookup success is obtained, an action record associated with the lookup success is retrieved, said action record containing a non-conflicting set of different actions associated with a plurality of filter rules that commonly apply to packets having the packet attribute values to enable all actions specified by the action records to be applied to the packets.
13. The method of claim 12 , wherein when the next attribute indication is obtained, the method further comprises the step of determining a subsequent packet attribute to be searched, obtaining a second packet attribute value associated with the attribute to be searched, and using the second packet attribute value as a key to a subsequent search that is to be performed in a subsequent attribute lookup table.
14. The method of claim 12 , further comprising the step of obtaining as a subsequent result of the subsequent search, at least one of lookup failure, lookup success, and a second next attribute indication.
15. The method of claim 14 , wherein the method further comprises the step of iterating the steps of determining a subsequent packet attribute and obtaining the subsequent result each time a second next attribute indication is obtained.
16. The method of claim 12 , further comprising determining an ACL for the packet, and wherein the step of using the first packet attribute value is performed in a lookup table created from ACEs associated with the ACL.
17. The method of claim 12 , wherein the lookup tables comprise radix tables.