Configurable access control lists using TCAM

1. A communication apparatus, comprising:

a content-Addressable Memory (CAM) storing in respective regions multiple Access Control Lists (ACLs) that are defined for respective packet types, wherein entries of at least one ACL, include an indication of a further ACL to which matching packets are to be applied; and

packet processing circuitry, which is configured to receive input communication packets, to classify each received input packet to a respective packet type, to identify a region of the CAM holding an ACL defined for the selected packet type, and to process the input packet in accordance with a matching entry in the ACL stored in the identified region, wherein when the matching entry indicates a further ACL to be applied to the packet, the packet processing circuitry processes the input packet in accordance with a matching entry in the further ACL,

wherein the entries of a first one of the ACLs have a next field with indications of further ACLs to be applied and the entries of a second one of the ACLs do not have a next field.

2. The apparatus according to claim 1 , wherein the CAM comprises a Ternary CAM (TCAM).

3. The apparatus according to claim 1 , wherein the packet processing circuitry is configured to store in a data structure external to the CAM respective entries that point to the regions defined for the packet types, and to identify the region holding the ACL defined for the selected packet type by querying an entry of the data structure corresponding to the selected packet type.

4. The apparatus according to claim 3 , wherein the packet processing circuitry is configured to configure the data structure or the CAM to apply two or more of the ACLs in cascade to one or more of the input communication packets.

5. The apparatus according to claim 3 , wherein the packet processing circuitry is configured to configure the data structure or the CAM to refrain from applying any of the ACLs to one or more of the input communication packets.

6. The apparatus according to claim 1 , wherein the packet processing circuitry is configured to receive the input packet over a given ingress port, and wherein the multiple ACLs are associated with the ingress port.

7. The apparatus according to claim 1 , wherein the input packet is associated with a given Virtual Local Area Network (VLAN), and wherein the multiple ACLs are associated with the VLAN.

8. The apparatus according to claim 1 , wherein the packet processing circuitry is configured to access first and second ACLs defined respectively for first and second packet types using respective first and second keys having different lengths.

9. The apparatus according to claim 1 , wherein the packet processing circuitry is configured to access first and second ACLs defined respectively for first and second packet types using respective first and second keys of the same length.

10. A method for communication, comprising:

storing in respective regions of a Content-Addressable Memory (CAM) multiple Access Control Lists (ACLs) that are defined for respective packet types, wherein entries of at least one ACL, include an indication of a further ACL to which matching packets are to be applied;

classifying an input packet to a respective packet type selected from a plurality of packet types;

identifying a region holding an ACL defined for the selected packet type; and

processing the input packet in accordance with a matching entry in a first ACL stored in the identified region, the processing including accessing an entry matching the input packet in a second ACL, the identity of which was indicated in the matching entry of the first ACL,

wherein the entries of a first one of the ACLs have a next field with indications of further ACLs to be applied and the entries of a second one of the ACLs do not have a next field.

11. The method according to claim 10 , wherein the CAM comprises a Ternary CAM (TCAM).

12. The method according to claim 10 , and comprising storing in a data structure external to the CAM respective entries that point to the regions defined for the packet types, wherein identifying the region comprises querying an entry of the data structure corresponding to the selected packet type, so as to identify the region holding the ACL defined for the selected packet type.

13. The method according to claim 12 , wherein storing the entries comprises configuring the data structure or the CAM to apply two or more of the ACLs in cascade to packets of one or more packet types.

14. The method according to claim 12 , wherein storing the entries comprises configuring the data structure or the CAM to refrain from applying any of the ACLs to packets of one or more packet types.

15. The method according to claim 10 , wherein the multiple ACLs are associated with an ingress port over which the input packet is received.

16. The method according to claim 10 , wherein the multiple ACLs are associated with a Virtual Local Area Network (VLAN) with which the input packet is associated.

17. The method according to claim 10 , and comprising accessing first and second ACLs defined respectively for first and second packet types using respective first and second keys having different lengths.

18. The method according to claim 10 , and comprising accessing first and second ACLs defined respectively for first and second packet types using respective first and second keys of the same length.