WO2016091027A1 - 一种网络地址转换与访问控制列表规则聚合方法和装置 - Google Patents

一种网络地址转换与访问控制列表规则聚合方法和装置 Download PDF

Info

Publication number
WO2016091027A1
WO2016091027A1 PCT/CN2015/093207 CN2015093207W WO2016091027A1 WO 2016091027 A1 WO2016091027 A1 WO 2016091027A1 CN 2015093207 W CN2015093207 W CN 2015093207W WO 2016091027 A1 WO2016091027 A1 WO 2016091027A1
Authority
WO
WIPO (PCT)
Prior art keywords
rule
acl
rule table
nat
aggregation
Prior art date
Application number
PCT/CN2015/093207
Other languages
English (en)
French (fr)
Inventor
魏巍
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2016091027A1 publication Critical patent/WO2016091027A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming

Definitions

  • This application relates to, but is not limited to, data communication techniques.
  • NAT Network Address Translation
  • IP address of the local host is translated into an external network IP address for network access.
  • NAT can use a small number of public IP addresses to represent more private IP addresses, thus effectively alleviating the problem of depletion of available IP address space.
  • An Access Control List is a list of commands for routers and switch interfaces that control the incoming and outgoing packets of a port.
  • the ACL contains matching relationships, conditions, and query statements. It is a framework structure whose purpose is to control some kind of access.
  • NAT When NAT performs dynamic address translation, it needs to match the ACL rules and then perform NAT address translation on the matched packets.
  • the embodiment of the invention provides a network address translation and ACL rule aggregation method and device, which can reduce the number of queries and hits during subsequent packet forwarding, improve packet forwarding performance, and reduce forwarding costs.
  • a network address translation NAT and an access control list ACL rule aggregation method includes:
  • the establishing the first rule table according to the NAT rule table includes: copying each rule in the NAT rule table into the first rule table.
  • the comparing each rule in the first rule table with the rule in the ACL rule table, and establishing the second rule table according to the comparison result includes:
  • the rule in the selected first rule table is deleted, and the next rule and ACL rule in the first rule table are re-selected.
  • the rules in the table are compared;
  • the rule in the selected first rule table is compared with the next rule in the ACL rule table.
  • the method further includes: determining an allowed state of the ACL rule table; and correspondingly, when the ACL rule table is allowed,
  • the method further includes: writing the rule in the selected first rule table into the second rule table;
  • the method further includes: writing the part included in the ACL rule in the rule in the selected first rule table Second rule table.
  • the rules in the selected first rule table are all included in the current ACL rule.
  • a network address translation and access control list rule aggregation device includes: a first rule table creation module, a rule comparison module, and a rule aggregation module;
  • the first rule table establishing module is configured to: establish a first rule table according to the NAT rule table;
  • the rule comparison module is configured to: compare each rule in the first rule table with a rule in the ACL rule table, and establish a second rule table according to the comparison result;
  • the rule aggregation module is configured to: perform rule aggregation on the ACL rule table and the second rule table to generate a NAT and ACL rule aggregation table.
  • the first rule table establishing module is configured to: copy each rule in the NAT rule table into the first rule table.
  • the rule comparison module is configured to: select the first rule in the current first rule table, and first compare with the first rule in the ACL rule table;
  • the rule in the selected first rule table is deleted, and the next rule and ACL rule in the first rule table are re-selected.
  • the rules in the table are compared;
  • the rule in the selected first rule table is compared with the next rule in the ACL rule table.
  • the rule comparison module is further configured to: determine an allowed state of the ACL rule table; and correspondingly, when the ACL rule table is allowed,
  • the method further includes: writing the rule in the selected first rule table into the second rule table;
  • the method further includes: writing the part included in the ACL rule in the rule in the selected first rule table Second rule table.
  • the rule comparison module is further configured to: when the ACL rule for comparison is When the last rule in the ACL rule table is used, the rules in the selected first rule table are all included in the current ACL rule.
  • a computer readable storage medium storing computer executable instructions for performing the method of any of the above.
  • the NAT and ACL rule aggregation method and apparatus provided by the embodiment of the present invention first establish a first rule table according to the NAT rule table; then compare each rule in the first rule table with a rule in the ACL rule table, according to comparison As a result, a second rule table is established; then the ACL rule table and the second rule table are subjected to rule aggregation to generate a NAT and ACL rule aggregation table. In this manner, in the subsequent packet forwarding process, the NAT and ACL rule aggregation table can be queried only once, and the packet filtering and address translation can be completed, thereby saving the processing time of packet forwarding and improving the performance of packet forwarding. Reduce the time cost of message forwarding.
  • FIG. 1 is a schematic flowchart of a method for aggregation of NAT and ACL rules according to an embodiment of the present invention
  • FIG. 2 is a schematic flowchart of a method for aggregation of NAT and ACL rules according to Embodiment 2 of the present invention
  • FIG. 3 is a schematic flowchart of a method for updating a rule in a first rule table selected according to an embodiment of the present invention
  • FIG. 4 is a schematic structural diagram of an apparatus for aggregating NAT and ACL rules according to an embodiment of the present invention.
  • the first rule table is first established according to the NAT rule table; then each rule in the first rule table is compared with the rule in the ACL rule table, and the second rule table is established according to the comparison result;
  • the ACL rule table and the second rule table perform rule aggregation to generate a NAT and ACL rule aggregation table.
  • the establishing the first rule table according to the NAT rule table includes: copying each rule in the NAT rule table to the first rule table respectively; wherein the first rule table is a temporary rule table, NAT rules need to be modified during the process of NAT and ACL rule aggregation. Delete the operation, and the NAT rule table is not changeable. Therefore, each rule in the NAT rule table needs to be copied to the first rule table separately, so that it can be in the NAT rule table during the comparison process. The rules are changed.
  • the second rule table is also a temporary rule table, which is used to record the result outputted by the rule in the first rule table after being compared with the ACL rule table.
  • the first rule table is a temporary NAT comparison rule table
  • the second rule table is a temporary NAT comparison rule table.
  • FIG. 1 is a schematic flowchart of a NAT and ACL rule aggregation method according to an embodiment of the present invention. As shown in FIG. 1 , the NAT and ACL rule aggregation method in the embodiment of the present invention includes the following steps:
  • Step 101 Establish a first rule table according to the NAT rule table.
  • the establishing the first rule table according to the NAT rule table includes: copying each rule in the NAT rule table to the first rule table.
  • Step 102 Compare each rule in the first rule table with a rule in the ACL rule table, and establish a second rule table according to the comparison result;
  • the comparing each rule in the first rule table with the rule in the ACL rule table, and establishing the second rule table according to the comparison result includes:
  • A Select the first rule in the current first rule table, and compare it with the first rule in the ACL rule table.
  • updating the rule in the selected first rule table to a part of the rule in the selected first rule table that is not included in the ACL rule table includes:
  • the part not included in the ACL rule table may be a network segment address, a subnet address, or a host address; when the part not included in the ACL rule table is a subnet address or a host address, directly use the The part not included in the ACL rule table replaces the rule in the currently selected first rule table, and the process ends.
  • the network segment address is split one by one, and the split subnet address is inserted after the rule in the currently selected first rule table.
  • the split network segment address replaces the network segment address before the split, and the splitting is continued. The loop is repeated until the network segment address is split into subnet addresses or a single host address, and inserted into the currently selected first rule table. The process ends after the rule.
  • step B1 is performed.
  • Step 103 Perform rule aggregation on the ACL rule table and the second rule table to generate a NAT and ACL rule aggregation table.
  • the ACL rule table and the second rule table are combined in order to generate a NAT and ACL rule aggregation table.
  • the second rule table is first copied to In the NAT and ACL rule aggregation table, the ACL rule table is copied to the NAT and ACL rule aggregation table.
  • the query is hit according to the above sequence.
  • FIG. 2 is a schematic flowchart of a NAT and ACL rule aggregation method according to Embodiment 2 of the present invention. As shown in FIG. 2, the NAT and ACL rule aggregation method in the embodiment of the present invention includes the following steps:
  • Step 201 Copy each rule in the NAT rule table to the first rule table.
  • Step 202 traverse the first rule table, determine whether the first rule table is empty; when the first rule table is empty, step 213 is performed, otherwise, step 203 is performed;
  • Step 203 Select a rule from the first rule table.
  • the first rule in the first order can be selected from the first rule table, and then each item is selected in turn, or one rule can be arbitrarily selected from the first rule table at a time, as long as each rule is guaranteed. All are selected and compared.
  • Step 204 Determine whether there is any next rule in the ACL rule table that is not compared with the rule selected in step 203. If the ACL rule table has a next rule that is not compared, go to step 205; otherwise, go back to step 202. ;
  • the ACL rule table has been traversed. That is, the rule selected in step 203 is compared with all the rules in the ACL rule table.
  • Step 205 Compare the rule in the selected first rule table with the next rule in the ACL rule table.
  • Step 206 Determine whether the rule in the selected first rule table is included in the rule in the ACL rule table; when all the rules in the selected first rule table are included in the current ACL rule table In this rule, step 207 is performed; when the rule part in the selected first rule table is included in the current rule in the current ACL rule table, step 210 is performed; when the selected first rule is performed If the rule in the table is not included in the current rule in the current ACL rule table, return to step 204;
  • the ACL rule for comparison is the last rule in the ACL rule table, it is considered that all the rules in the selected first rule table are included in the current ACL rule.
  • Step 207 Determine the permission state of the current ACL rule table; when the state of the ACL rule table is permit, step 208 is performed; when the state of the ACL rule table is deny, step 209 is performed;
  • Step 208 Write the rule in the selected first rule table to the end of the second rule table; and perform step 209;
  • Step 209 Delete the rule in the selected first rule table; return to step 202;
  • Step 210 Determine the permission state of the current ACL rule table; when the state of the ACL rule table is permit, step 211 is performed; when the state of the ACL rule table is deny, step 212 is performed;
  • Step 211 Split the rule in the first rule table into a part included in the ACL rule table and a part not included in the ACL rule table, and write the part included in the ACL rule table into the second rule. The end of the table; and perform step 212;
  • Step 212 The rule in the selected first rule table is updated to the part of the selected first rule table that is not included in the ACL rule table; return to step 204;
  • Step 213 Perform rule aggregation on the ACL rule table and the second rule table to generate a NAT and ACL rule aggregation table.
  • the ACL rule table and the second rule table are combined in order to generate a NAT and ACL rule aggregation table.
  • the second rule table is copied to the NAT and ACL rule aggregation table, and then the ACL rule table is copied to the NAT and ACL rule aggregation table.
  • the NAT and ACL rule aggregation is queried. For the table, the query hits in the above order.
  • the step 212 is to update the rule in the selected first rule table to the implementation process of the part in the selected first rule table that is not included in the ACL rule table, as shown in FIG. 3 .
  • 3 is a schematic flowchart of a method for updating a rule in a first rule table selected by an embodiment of the present invention. As shown in FIG. 3, the method includes the following steps:
  • Step 301 Determine a type of the part that is not included in the ACL rule table.
  • the part not included in the ACL rule table may be a network segment address, a subnet address, or a host address; when the part not included in the ACL rule table is a subnet address or a main When the address is not used, step 302 is performed; when the part not included in the ACL rule table is a network segment address, step 303 is performed;
  • Step 302 Replace the rule in the currently selected first rule table with the part not included in the ACL rule table; the process ends;
  • Step 303 Split the network segment address one by one
  • Step 306 Determine whether the segmentation result of the network segment address is a subnet address or a network segment address; when the subnet address is split, step 305 is performed; when the network segment address is split, step 306 is performed;
  • Step 305 Insert the split subnet address into the rule in the first selected first rule table
  • Step 306 Replace the split network segment address with the network segment address before the split, and return to step 303;
  • the loop splitting is performed until the network segment address is split into a subnet address or a single host address and inserted into the rule in the currently selected first rule table, and the process ends.
  • FIG. 4 is a schematic structural diagram of a NAT and ACL rule aggregation device according to an embodiment of the present invention. As shown in FIG. 4, the device includes a first rule table establishing module 41. a rule comparison module 42 and a rule aggregation module 43; wherein
  • the first rule table establishing module 41 is configured to: establish a first rule table according to the NAT rule table;
  • the first rule table establishing module 41 is configured to: copy each rule in the NAT rule table to the first rule table.
  • the rule comparison module 42 is configured to: compare each rule in the first rule table with a rule in the ACL rule table, and establish a second rule table according to the comparison result;
  • the rule comparison module 42 is configured to: select the first rule in the current first rule table, and first compare with the first rule in the ACL rule table;
  • the rules in the selected first rule table are all included in the ACL rule, further determine an allowed state of the ACL rule table, and when the ACL rule table state is permit, the selected The rule in the first rule table is written in the tail of the second rule table, and the rule in the selected first rule table is deleted; when the state of the ACL rule table is deny, directly Deleting the rule in the selected first rule table; after that, reselecting the next rule in the first rule table and comparing the rule in the ACL rule table;
  • the selected first The rule included in the rule table includes a part in the ACL rule written in the end of the second rule table, and replaces the rule in the selected first rule table with a part not included in the ACL rule table, that is, the selected first
  • the rule in a rule table is updated to a part of the rule in the selected first rule table that is not included in the ACL rule table; when the state of the ACL rule table is deny, the selected one is directly selected.
  • the rule in the first rule table is updated to a part of the rule in the selected first rule table that is not included in the ACL rule table; after that, the rule in the currently selected first rule table and the rule in the ACL rule table are The next rule is compared;
  • the rule comparison module 42 updates the rule in the selected first rule table to a part of the rule in the selected first rule table that is not included in the ACL rule table, including:
  • the part not included in the ACL rule table may be a network segment address, a subnet address, or a host address; when the part not included in the ACL rule table is a subnet address or a host address, directly use the The part not included in the ACL rule table replaces the rule in the currently selected first rule table, and the process ends.
  • the network segment address is split one by one, and the split subnet address is inserted after the rule in the currently selected first rule table.
  • the split network segment address replaces the network segment address before the split, and the splitting is continued. The loop is repeated until the network segment address is split into subnet addresses or a single host address, and inserted into the currently selected first rule table. The process ends after the rule.
  • the rule in the selected first rule table is compared with the next rule in the ACL rule table.
  • the rule comparison module 42 is further configured to: when the ACL rule for comparison is the last rule in the ACL rule table, the selected first rule table The rules in are all included in the current ACL rule.
  • the rule aggregation module 43 is configured to perform rule aggregation on the ACL rule table and the second rule table to generate a NAT and ACL rule aggregation table.
  • the rule aggregation module 43 is configured to combine the ACL rule table and the second rule table in order to generate a NAT and ACL rule aggregation table.
  • the second rule table is first copied to the NAT and ACL rule aggregation table, and then the ACL rule table is copied to the NAT and ACL rule aggregation table.
  • the NAT and the ACL are queried.
  • the query hits in the above order.
  • each processing module in the NAT and ACL rule aggregation apparatus shown in FIG. 4 can be understood by referring to the related description of the foregoing NAT and ACL rule aggregation methods. It should be understood by those skilled in the art that the functions of each processing unit in the NAT and ACL rule aggregation apparatus shown in FIG. 4 can be implemented by a program running on a processor, or can be implemented by a logic circuit, for example, can be processed by the central processing. (CPU), Microprocessor (MPU), Digital Signal Processor (DSP), or Field Programmable Gate Array (FPGA) implementation; the memory unit can also be implemented by various memories, or storage media.
  • CPU Central Processing
  • MPU Microprocessor
  • DSP Digital Signal Processor
  • FPGA Field Programmable Gate Array
  • all or part of the steps of the above embodiments may also be implemented by using an integrated circuit. These steps may be separately fabricated into individual integrated circuit modules, or multiple modules or steps may be fabricated into a single integrated circuit module. achieve.
  • the devices/function modules/functional units in the above embodiments may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices.
  • the device/function module/functional unit in the above embodiment When the device/function module/functional unit in the above embodiment is implemented in the form of a software function module and sold or used as a stand-alone product, it can be stored in a computer readable storage medium.
  • the above mentioned computer readable storage medium may be a read only memory, a magnetic disk or an optical disk or the like.
  • the packet forwarding process and the ACL rule aggregation table can be queried only once, and the packet filtering and address translation can be completed, thereby saving the time for processing the packet forwarding and improving packet forwarding. Performance reduces the time cost of message forwarding.

Abstract

本文公布一种网络地址转换(NAT)与访问控制列表(ACL)规则聚合方法和装置，所述方法包括：根据NAT规则表建立第一规则表；将第一规则表中的每条规则与ACL规则表中的规则进行比较，根据比较结果建立第二规则表；将所述ACL规则表与第二规则表进行规则聚合，生成NAT与ACL规则聚合表。

Description

一种网络地址转换与访问控制列表规则聚合方法和装置 技术领域
本申请涉及但不限于数据通信技术。
背景技术
网络地址转换(NAT，Network Address Translation)应用于内部主机访问外部网络时，将本地主机的IP地址转换成外网IP地址，进行网络访问。通过NAT可以使用少量的公有IP地址代表较多的私有IP地址，从而有效缓解可用IP地址空间枯竭的问题。
访问控制列表(ACL，Access Control List)是路由器和交换机接口的指令列表，用来控制端口进出的数据包。ACL中包含了匹配关系、条件和查询语句，是一个框架结构，其目的是为了对某种访问进行控制。
NAT在进行动态地址转换时，需要先通过ACL规则进行匹配，将匹配到的报文再进行NAT地址转换。
相关技术中的设备在进行报文转发时，如果报文同时需要进行NAT和ACL，大多采用的是顺序匹配方法，即：执行完ACL再进行NAT，或执行完NAT再执行ACL，这就需要进行两次处理，涉及查询两张表格并进行两次命中，报文转发所需要的时间成本较高。
发明内容
以下是对本文详细描述的主题的概述。本概述并非是为了限制权利要求的保护范围。
本发明实施例提供一种网络地址转换与访问控制列表规则聚合方法和装置，能够减小后续报文转发时的查询和命中次数，提升报文转发性能，降低转发成本。
一种网络地址转换NAT与访问控制列表ACL规则聚合方法，所述方法包括：
根据NAT规则表建立第一规则表；
将第一规则表中的每条规则与ACL规则表中的规则进行比较，根据比较结果建立第二规则表；
将所述ACL规则表与第二规则表进行规则聚合，生成NAT与ACL规则聚合表。
可选地，所述根据NAT规则表建立第一规则表包括：将所述NAT规则表中的每个规则分别复制到第一规则表中。
可选地，所述将第一规则表中的每条规则与ACL规则表中的规则进行比较，根据比较结果建立第二规则表包括：
选取当前第一规则表中的第一条规则，先与ACL规则表中的第一条规则进行比较；
当所述选取的第一规则表中的规则全部包含在所述ACL规则中时，删除所述选取的第一规则表中的规则，并重新选取第一规则表中的下一条规则与ACL规则表中的规则进行比较；
当所述选取的第一规则表中的规则部分包含在ACL规则中时，将所述选取的第一规则表中的规则更新为所述选取的第一规则表中的规则中不包含在ACL规则表中的部分，并与ACL规则表中的下一条规则进行比较；
当所述选取的第一规则表中的规则不包含在ACL规则表中时，将所述选取的第一规则表中的规则与ACL规则表中的下一条规则进行比较。
可选地，所述方法还包括：判断ACL规则表的允许状态；相应地，当所述ACL规则表为允许的时，
在所述选取的第一规则表中的规则全部包含在所述ACL规则中的情况下，所述方法还包括：将所述选取的第一规则表中的规则写入第二规则表；
在所述选取的第一规则表中的规则部分包含在ACL规则中的情况下，所述方法还包括：将所述选取的第一规则表中的规则中包含在ACL规则中的部分写入第二规则表。
可选地，当所述用于比较的ACL规则为所述ACL规则表中的最后一条规则时，所述选取的第一规则表中的规则全部包含在当前ACL规则中。
一种网络地址转换与访问控制列表规则聚合装置，所述装置包括：第一规则表建立模块、规则比较模块、规则聚合模块；其中，
所述第一规则表建立模块，设置为：根据NAT规则表建立第一规则表；
所述规则比较模块，设置为：将第一规则表中的每条规则与ACL规则表中的规则进行比较，根据比较结果建立第二规则表；
所述规则聚合模块，设置为：将所述ACL规则表与第二规则表进行规则聚合，生成NAT与ACL规则聚合表。
可选地，所述第一规则表建立模块是设置为：将所述NAT规则表中的每个规则分别复制到第一规则表中。
可选地，所述规则比较模块是设置为：选取当前第一规则表中的第一条规则，先与ACL规则表中的第一条规则进行比较；
当所述选取的第一规则表中的规则全部包含在所述ACL规则中时，删除所述选取的第一规则表中的规则，并重新选取第一规则表中的下一条规则与ACL规则表中的规则进行比较；
当所述选取的第一规则表中的规则部分包含在ACL规则中时，将所述选取的第一规则表中的规则更新为所述选取的第一规则表中的规则中不包含在ACL规则表中的部分，并与ACL规则表中的下一条规则进行比较；
当所述选取的第一规则表中的规则不包含在ACL规则表中时，将所述选取的第一规则表中的规则与ACL规则表中的下一条规则进行比较。
可选地，所述规则比较模块还设置为：判断ACL规则表的允许状态；相应地，当所述ACL规则表为允许的时，
在所述选取的第一规则表中的规则全部包含在所述ACL规则中的情况下，所述方法还包括：将所述选取的第一规则表中的规则写入第二规则表；
在所述选取的第一规则表中的规则部分包含在ACL规则中的情况下，所述方法还包括：将所述选取的第一规则表中的规则中包含在ACL规则中的部分写入第二规则表。
可选地，所述规则比较模块还设置为：当所述用于比较的ACL规则为 所述ACL规则表中的最后一条规则时，所述选取的第一规则表中的规则全部包含在当前ACL规则中。
一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行上述任一项的方法。
本发明实施例所提供的NAT与ACL规则聚合方法和装置，先根据NAT规则表建立第一规则表；然后将第一规则表中的每条规则与ACL规则表中的规则进行比较，根据比较结果建立第二规则表；之后将所述ACL规则表与第二规则表进行规则聚合，生成NAT与ACL规则聚合表。如此，能够在后续的报文转发过程中，只查询一次NAT与ACL规则聚合表进行一次命中，就可以完成包过滤和地址转换，从而节省报文转发时处理的时间，提升报文转发的性能，降低报文转发的时间成本。
在阅读并理解了附图和详细描述后，可以明白其他方面。
附图概述
图1为本发明实施例一NAT与ACL规则聚合方法流程示意图；
图2为本发明实施例二NAT与ACL规则聚合方法流程示意图；
图3为本发明实施例选取的第一规则表中的规则更新方法流程示意图；
图4为本发明实施例NAT与ACL规则聚合装置结构示意图。
本发明的实施方式
本发明实施例中，先根据NAT规则表建立第一规则表；然后将第一规则表中的每条规则与ACL规则表中的规则进行比较，根据比较结果建立第二规则表；之后将所述ACL规则表与第二规则表进行规则聚合，生成NAT与ACL规则聚合表。
这里，所述根据NAT规则表建立第一规则表包括：将所述NAT规则表中的每个规则分别复制到第一规则表中；其中，所述第一规则表为临时规则表，由于建立NAT与ACL规则聚合表的过程中需要对NAT规则进行修改、 删除等操作，而NAT规则表不具备可更改性，因此，需要将所述NAT规则表中的每个规则分别复制到第一规则表中，以便在比较的过程中能对NAT规则表中的规则进行更改。
所述第二规则表同样为临时规则表，用于记录所述第一规则表中的规则与ACL规则表比较后输出的结果。本发明实施例中，所述第一规则表为临时NAT比较前规则表，所述第二规则表为临时NAT比较后规则表。
下面结合附图对本发明的实施方式进行描述。图1为本发明实施例一NAT与ACL规则聚合方法流程示意图，如图1所示，本发明实施例NAT与ACL规则聚合方法包括以下步骤：
步骤101：根据NAT规则表建立第一规则表；
本发明实施例中，所述根据NAT规则表建立第一规则表包括：将所述NAT规则表中的每个规则分别复制到第一规则表中。
步骤102：将第一规则表中的每条规则与ACL规则表中的规则进行比较，根据比较结果建立第二规则表；
本发明实施例中，所述将第一规则表中的每条规则与ACL规则表中的规则进行比较，根据比较结果建立第二规则表包括：
A：选取当前第一规则表中的第一条规则，先与ACL规则表中的第一条规则进行比较；
B1：当所述选取的第一规则表中的规则全部包含在所述ACL规则中时，进一步判断ACL规则表的允许状态，当所述ACL规则表状态为允许(permit)时，将所述选取的第一规则表中的规则写入第二规则表尾部，并删除所述选取的第一规则表中的规则；当所述ACL规则表状态为拒绝(deny)时，直接删除所述选取的第一规则表中的规则；之后，重新选取第一规则表中的下一条规则与ACL规则表中的规则进行比较；
B2：当所述选取的第一规则表中的规则部分包含在ACL规则中时，进一步判断ACL规则表的允许状态，当所述ACL规则表状态为允许(permit)时，将所述选取的第一规则表中的规则中包含在ACL规则中的部分写入第二规则表尾部，用所述选取的第一规则表中的规则中不包含在ACL规则表 中的部分替换所述选取的第一规则表中的规则，即将所述选取的第一规则表中的规则更新为所述选取的第一规则表中的规则中不包含在ACL规则表中的部分；当所述ACL规则表状态为拒绝(deny)时，直接将所述选取的第一规则表中的规则更新为所述选取的第一规则表中的规则中不包含在ACL规则表中的部分；之后，将当前选取的第一规则表中的规则与ACL规则表中的下一条规则进行比较；
这里，将所述选取的第一规则表中的规则更新为所述选取的第一规则表中的规则中不包含在ACL规则表中的部分包括：
拆分选取的第一规则表中的规则，将所述规则拆分为：包含在ACL规则表中的部分和不包含在ACL规则表中的部分；
这里，不包含在ACL规则表中的部分有可能为网段地址、子网地址或主机地址；当所述不包含在ACL规则表中的部分为子网地址或主机地址时，直接用所述不包含在ACL规则表中的部分替换当前选取的第一规则表中的规则，该流程结束。
当所述不包含在ACL规则表中的部分为网段地址时，则逐个拆分所述网段地址，将拆分出的子网地址插入到当前选取的第一规则表中的规则后面，拆分出的网段地址替换拆分前的网段地址，继续进行拆分，如此循环，直至网段地址均拆分成子网地址或单个主机地址、并插入到当前选取的第一规则表中的规则后面为止，该流程结束。
B3：当所述选取的第一规则表中的规则不包含在ACL规则表中时，将所述选取的第一规则表中的规则与ACL规则表中的下一条规则进行比较。
这里，当所述用于比较的ACL规则为所述ACL规则表中的最后一条规则时，则认为所述选取的第一规则表中的规则全部包含在当前ACL规则中，并执行步骤B1。
步骤103：将所述ACL规则表与第二规则表进行规则聚合，生成NAT与ACL规则聚合表。
这里，是将所述ACL规则表与第二规则表按照顺序进行合并，生成NAT与ACL规则聚合表。其中，按照先后顺序，首先将第二规则表拷贝到 NAT与ACL规则聚合表中，然后再将ACL规则表拷贝到NAT与ACL规则聚合表中；在后续报文转发过程中，查询NAT与ACL规则聚合表时，按照上述先后顺序进行查询命中。
图2为本发明实施例二NAT与ACL规则聚合方法流程示意图，如图2所示，本发明实施例NAT与ACL规则聚合方法包括以下步骤：
步骤201：将所述NAT规则表中的每个规则复制到第一规则表中；
步骤202：遍历所述第一规则表，判断所述第一规则表是否为空；当所述第一规则表为空时，执行步骤213，否则，执行步骤203；
步骤203：从所述第一规则表中选取一条规则；
本步骤中，可以从第一规则表中选取当前排序在最前的第一条规则，之后依次选取每一条，也可以每次从所述第一规则表中任意选取一条规则，只要保证每条规则都选取到并进行比较即可。
步骤204：判断ACL规则表中是否还有未与步骤203中选取的规则进行比较的下一条规则；如果ACL规则表还有未进行比较的下一条规则，则执行步骤205；否则，返回步骤202；
当ACL规则表不存在未进行比较的规则，则说明ACL规则表已遍历完成，即步骤203中选取的规则与ACL规则表中的所有规则都比较完成。
步骤205：将所述选取的第一规则表中的规则与ACL规则表中的下一条规则进行比较；
步骤206：判断所述选取的第一规则表中的规则是否包含在所述ACL规则表中的这一条规则中；当所述选取的第一规则表中的规则全部包含在当前ACL规则表中的这一条规则中时，执行步骤207；当所述选取的第一规则表中的规则部分包含在当前ACL规则表中的这一条规则中时，执行步骤210；当所述选取的第一规则表中的规则不包含在当前ACL规则表中的这一条规则中时，返回步骤204；
这里，当所述用于比较的ACL规则为所述ACL规则表中的最后一条规则时，则认为所述选取的第一规则表中的规则全部包含在当前ACL规则中。
步骤207：判断当前ACL规则表的允许状态；当所述ACL规则表的状态为允许(permit)时，执行步骤208；当所述ACL规则表的状态为拒绝(deny)时，执行步骤209；
步骤208：将所述选取的第一规则表中的规则写入第二规则表尾部；并执行步骤209；
步骤209：删除所述选取的第一规则表中的规则；返回步骤202；
步骤210：判断当前ACL规则表的允许状态；当所述ACL规则表的状态为允许(permit)时，执行步骤211；所述ACL规则表的状态为拒绝(deny)时，执行步骤212；
步骤211：将所述第一规则表中的规则拆分为包含在ACL规则表中的部分和不包含在ACL规则表中部分，将所述包含在ACL规则表中的部分写入第二规则表尾部；并执行步骤212；
步骤212：将所述选取的第一规则表中的规则更新为所述选取的第一规则表中的规则中不包含在ACL规则表中的部分；返回步骤204；
步骤213：将所述ACL规则表与第二规则表进行规则聚合，生成NAT与ACL规则聚合表。
本发明实施例中，将所述ACL规则表与第二规则表按照顺序进行合并，生成NAT与ACL规则聚合表。
按照先后顺序，首先将第二规则表拷贝到NAT与ACL规则聚合表中，然后再将ACL规则表拷贝到NAT与ACL规则聚合表中；在后续报文转发过程中，查询NAT与ACL规则聚合表时，按照上述先后顺序进行查询命中。
本发明实施例中，步骤212将所述选取的第一规则表中的规则更新为所述选取的第一规则表中的规则中不包含在ACL规则表中的部分的实现过程如图3所示，图3为本发明实施例选取的第一规则表中的规则更新方法流程示意图，如图3所示，包括以下步骤：
步骤301：判断所述不包含在ACL规则表中的部分的类型；
本步骤中，所述不包含在ACL规则表中的部分有可能为网段地址、子网地址或主机地址；当所述不包含在ACL规则表中的部分为子网地址或主 机地址时，执行步骤302；当所述不包含在ACL规则表中的部分为网段地址时，执行步骤303；
步骤302：用所述不包含在ACL规则表中的部分替换当前选取的第一规则表中的规则；该流程结束；
步骤303：逐个拆分所述网段地址；
步骤304：判断所述网段地址的拆分结果是子网地址还是网段地址；当拆分出子网地址时，执行步骤305；当拆分出网段地址时，执行步骤306；
步骤305：将拆分出的子网地址插入到前选取的第一规则表中的规则后面；
步骤306：将拆分出的网段地址替换拆分前的网段地址，并返回步骤303；
如此进行循环拆分，直至网段地址均拆分成子网地址或单个主机地址、并插入到当前选取的第一规则表中的规则后面为止，该流程结束。
本发明实施例还提供了一种NAT与ACL规则聚合装置，图4为本发明实施例NAT与ACL规则聚合装置结构示意图，如图4所示，所述装置包括第一规则表建立模块41、规则比较模块42、规则聚合模块43；其中，
所述第一规则表建立模块41，设置为：根据NAT规则表建立第一规则表；
本发明实施例中，所述第一规则表建立模块41是设置为：将所述NAT规则表中的每个规则分别复制到第一规则表中。
所述规则比较模块42，设置为：将第一规则表中的每条规则与ACL规则表中的规则进行比较，根据比较结果，建立第二规则表；
本发明实施例中，所述规则比较模块42是设置为：选取当前第一规则表中的第一条规则，先与ACL规则表中的第一条规则进行比较；
当所述选取的第一规则表中的规则全部包含在所述ACL规则中时，进一步判断ACL规则表的允许状态，当所述ACL规则表状态为允许(permit)时，将所述选取的第一规则表中的规则写入第二规则表尾部，并删除所述选取的第一规则表中的规则；当所述ACL规则表状态为拒绝(deny)时，直接 删除所述选取的第一规则表中的规则；之后，重新选取第一规则表中的下一条规则与ACL规则表中的规则进行比较；
当所述选取的第一规则表中的规则部分包含在ACL规则中时，进一步判断ACL规则表的允许状态，当所述ACL规则表状态为允许(permit)时，将所述选取的第一规则表中的规则中包含在ACL规则中的部分写入第二规则表尾部，用不包含在ACL规则表中的部分替换所述选取的第一规则表中的规则，即将所述选取的第一规则表中的规则更新为所述选取的第一规则表中的规则中不包含在ACL规则表中的部分；当所述ACL规则表状态为拒绝(deny)时，直接将所述选取的第一规则表中的规则更新为所述选取的第一规则表中的规则中不包含在ACL规则表中的部分；之后，将当前选取的第一规则表中的规则与ACL规则表中的下一条规则进行比较；
这里，所述规则比较模块42将所述选取的第一规则表中的规则更新为所述选取的第一规则表中的规则中不包含在ACL规则表中的部分包括：
拆分选取的第一规则表中的规则，将所述规则拆分为：包含在ACL规则表中的部分和不包含在ACL规则表中的部分；
这里，不包含在ACL规则表中的部分有可能为网段地址、子网地址或主机地址；当所述不包含在ACL规则表中的部分为子网地址或主机地址时，直接用所述不包含在ACL规则表中的部分替换当前选取的第一规则表中的规则，该流程结束。
当所述不包含在ACL规则表中的部分为网段地址时，则逐个拆分所述网段地址，将拆分出的子网地址插入到当前选取的第一规则表中的规则后面，拆分出的网段地址替换拆分前的网段地址，继续进行拆分，如此循环，直至网段地址均拆分成子网地址或单个主机地址、并插入到当前选取的第一规则表中的规则后面为止，该流程结束。
当所述选取的第一规则表中的规则不包含在ACL规则表中时，将所述选取的第一规则表中的规则与ACL规则表中的下一条规则进行比较。
本发明实施例中，所述规则比较模块42还设置为：当所述用于比较的ACL规则为所述ACL规则表中的最后一条规则时，所述选取的第一规则表 中的规则全部包含在当前ACL规则中。
所述规则聚合模块43，设置为：将所述ACL规则表与第二规则表进行规则聚合，生成NAT与ACL规则聚合表。
这里，所述规则聚合模块43是设置为：将所述ACL规则表与第二规则表按照顺序进行合并，生成NAT与ACL规则聚合表。
其中，按照先后顺序，首先将第二规则表拷贝到NAT与ACL规则聚合表中，然后再将ACL规则表拷贝到NAT与ACL规则聚合表中；在后续报文转发过程中，查询NAT与ACL规则聚合表时，按照上述先后顺序进行查询命中。
图4中所示的NAT与ACL规则聚合装置中的每个处理模块的实现功能，可参照前述NAT与ACL规则聚合方法的相关描述而理解。本领域技术人员应当理解，图4所示的NAT与ACL规则聚合装置中每个处理单元的功能可通过运行于处理器上的程序而实现，也可通过逻辑电路而实现，比如：可由中央处理器(CPU)、微处理器(MPU)、数字信号处理器(DSP)、或现场可编程门阵列(FPGA)实现；所述存储单元也可以由各种存储器、或存储介质实现。
本领域普通技术人员可以理解上述实施例的全部或部分步骤可以使用计算机程序流程来实现，所述计算机程序可以存储于一计算机可读存储介质中，所述计算机程序在相应的硬件平台上(如系统、设备、装置、器件等)执行，在执行时，包括方法实施例的步骤之一或其组合。
可选地，上述实施例的全部或部分步骤也可以使用集成电路来实现，这些步骤可以被分别制作成一个个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。
上述实施例中的装置/功能模块/功能单元可以采用通用的计算装置来实现，它们可以集中在单个的计算装置上，也可以分布在多个计算装置所组成的网络上。
上述实施例中的装置/功能模块/功能单元以软件功能模块的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。 上述提到的计算机可读取存储介质可以是只读存储器，磁盘或光盘等。
工业实用性
通过本发明实施例，能够在报文转发过程中，只查询一次NAT与ACL规则聚合表进行一次命中，就可以完成包过滤和地址转换，从而节省报文转发时处理的时间，提升报文转发的性能，降低报文转发的时间成本。

Claims (11)

  1. 一种网络地址转换NAT与访问控制列表ACL规则聚合方法，所述方法包括：
    根据NAT规则表建立第一规则表；
    将第一规则表中的每条规则与ACL规则表中的规则进行比较，根据比较结果建立第二规则表；
    将所述ACL规则表与第二规则表进行规则聚合，生成NAT与ACL规则聚合表。
  2. 根据权利要求1所述方法，其中，所述根据NAT规则表建立第一规则表包括：将所述NAT规则表中的每个规则分别复制到第一规则表中。
  3. 根据权利要求1所述方法，其中，所述将第一规则表中的每条规则与ACL规则表中的规则进行比较，根据比较结果建立第二规则表包括：
    选取当前第一规则表中的第一条规则，先与ACL规则表中的第一条规则进行比较；
    当所述选取的第一规则表中的规则全部包含在所述ACL规则中时，删除所述选取的第一规则表中的规则，并重新选取第一规则表中的下一条规则与ACL规则表中的规则进行比较；
    当所述选取的第一规则表中的规则部分包含在ACL规则中时，将所述选取的第一规则表中的规则更新为所述选取的第一规则表中的规则中不包含在ACL规则表中的部分，并与ACL规则表中的下一条规则进行比较；
    当所述选取的第一规则表中的规则不包含在ACL规则表中时，将所述选取的第一规则表中的规则与ACL规则表中的下一条规则进行比较。
  4. 根据权利要求3所述方法，所述方法还包括：判断ACL规则表的允许状态；相应地，当所述ACL规则表为允许的时，
    在所述选取的第一规则表中的规则全部包含在所述ACL规则中的情况下，所述方法还包括：将所述选取的第一规则表中的规则写入第二规则表；
    在所述选取的第一规则表中的规则部分包含在ACL规则中的情况下， 所述方法还包括：将所述选取的第一规则表中的规则中包含在ACL规则中的部分写入第二规则表。
  5. 根据权利要求3或4所述方法，其中，当所述用于比较的ACL规则为所述ACL规则表中的最后一条规则时，所述选取的第一规则表中的规则全部包含在当前ACL规则中。
  6. 一种网络地址转换与访问控制列表规则聚合装置，所述装置包括：第一规则表建立模块、规则比较模块、规则聚合模块；其中，
    所述第一规则表建立模块，设置为：根据NAT规则表建立第一规则表；
    所述规则比较模块，设置为：将第一规则表中的每条规则与ACL规则表中的规则进行比较，根据比较结果建立第二规则表；
    所述规则聚合模块，设置为：将所述ACL规则表与第二规则表进行规则聚合，生成NAT与ACL规则聚合表。
  7. 根据权利要求6所述装置，其中，所述第一规则表建立模块是设置为：将所述NAT规则表中的每个规则分别复制到第一规则表中。
  8. 根据权利要求6所述装置，其中，所述规则比较模块是设置为：选取当前第一规则表中的第一条规则，先与ACL规则表中的第一条规则进行比较；
    当所述选取的第一规则表中的规则全部包含在所述ACL规则中时，删除所述选取的第一规则表中的规则，并重新选取第一规则表中的下一条规则与ACL规则表中的规则进行比较；
    当所述选取的第一规则表中的规则部分包含在ACL规则中时，将所述选取的第一规则表中的规则更新为所述选取的第一规则表中的规则中不包含在ACL规则表中的部分，并与ACL规则表中的下一条规则进行比较；
    当所述选取的第一规则表中的规则不包含在ACL规则表中时，将所述选取的第一规则表中的规则与ACL规则表中的下一条规则进行比较。
  9. 根据权利要求8所述装置，其中，所述规则比较模块还设置为：判断ACL规则表的允许状态；相应地，当所述ACL规则表为允许的时，
    在所述选取的第一规则表中的规则全部包含在所述ACL规则中的情况下，所述方法还包括：将所述选取的第一规则表中的规则写入第二规则表；
    在所述选取的第一规则表中的规则部分包含在ACL规则中的情况下，所述方法还包括：将所述选取的第一规则表中的规则中包含在ACL规则中的部分写入第二规则表。
  10. 根据权利要求8或9所述装置，其中，所述规则比较模块还设置为：当所述用于比较的ACL规则为所述ACL规则表中的最后一条规则时，所述选取的第一规则表中的规则全部包含在当前ACL规则中。
  11. 一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行权利要求1-5任一项的方法。
PCT/CN2015/093207 2014-12-12 2015-10-29 一种网络地址转换与访问控制列表规则聚合方法和装置 WO2016091027A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410768111.7 2014-12-12
CN201410768111.7A CN105744010A (zh) 2014-12-12 2014-12-12 一种网络地址转换与访问控制列表规则聚合方法和装置

Publications (1)

Publication Number Publication Date
WO2016091027A1 true WO2016091027A1 (zh) 2016-06-16

Family

ID=56106655

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/093207 WO2016091027A1 (zh) 2014-12-12 2015-10-29 一种网络地址转换与访问控制列表规则聚合方法和装置

Country Status (2)

Country Link
CN (1) CN105744010A (zh)
WO (1) WO2016091027A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114362991A (zh) * 2021-11-22 2022-04-15 北京威努特技术有限公司 一种acl访问控制列表规则过滤去重的方法及装置

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107800627B (zh) * 2016-09-06 2021-04-06 中兴通讯股份有限公司 三态内容寻址存储器tcam表的写入方法及装置
CN107800816B (zh) * 2017-09-29 2020-11-03 中国平安人寿保险股份有限公司 一种ip地址数据库建立方法及终端设备
CN109472138B (zh) * 2017-12-01 2022-07-01 北京安天网络安全技术有限公司 一种检测snort规则冲突的方法、装置和存储介质

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101079798A (zh) * 2006-05-26 2007-11-28 华为技术有限公司 网络地址转换方法及实现访问控制列表的方法
US7467212B2 (en) * 2000-12-28 2008-12-16 Intel Corporation Control of access control lists based on social networks
CN103384222A (zh) * 2013-06-26 2013-11-06 汉柏科技有限公司 一种数据流匹配acl的方法

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7436770B2 (en) * 2004-01-21 2008-10-14 Alcatel Lucent Metering packet flows for limiting effects of denial of service attacks
CN1897564B (zh) * 2005-07-11 2010-04-14 中兴通讯股份有限公司 基于递归流分类算法的策略路由匹配方法
CN101035060A (zh) * 2006-03-08 2007-09-12 中兴通讯股份有限公司 一种三重内容可寻址存储器报文分类的统一处理方法

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7467212B2 (en) * 2000-12-28 2008-12-16 Intel Corporation Control of access control lists based on social networks
CN101079798A (zh) * 2006-05-26 2007-11-28 华为技术有限公司 网络地址转换方法及实现访问控制列表的方法
CN103384222A (zh) * 2013-06-26 2013-11-06 汉柏科技有限公司 一种数据流匹配acl的方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
ZOU, HANG; ET AL.: "Design of Integrated Network Security ACL and NAT Experiment", RESEARCH AND EXPLORATION IN LABORATORY, vol. 30, no. 4, 30 April 2011 (2011-04-30), ISSN: 1006-7167 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114362991A (zh) * 2021-11-22 2022-04-15 北京威努特技术有限公司 一种acl访问控制列表规则过滤去重的方法及装置
CN114362991B (zh) * 2021-11-22 2024-04-16 北京威努特技术有限公司 一种acl访问控制列表规则过滤去重的方法及装置

Also Published As

Publication number Publication date
CN105744010A (zh) 2016-07-06

Similar Documents

Publication Publication Date Title
US10534547B2 (en) Consistent transition from asynchronous to synchronous replication in hash-based storage systems
US10778583B2 (en) Chained longest prefix matching in programmable switch
EP3913480A1 (en) Method and apparatus for determining virtual machine migration
EP2863310B1 (en) Data processing method and apparatus, and shared storage device
US9473502B2 (en) Atomically updating ternary content addressable memory-based access control lists
US20180097730A1 (en) Supporting access control list rules that apply to tcp segments belonging to 'established' connection
US9300692B2 (en) System and method for implementing data migration while preserving security policies of a source filer
WO2016091027A1 (zh) 一种网络地址转换与访问控制列表规则聚合方法和装置
CN108363621B (zh) numa架构下的报文转发方法、装置、存储介质及电子设备
US20140201307A1 (en) Caching of look-up rules based on flow heuristics to enable high speed look-up
JP2016515367A (ja) 分配型フローテーブルを有するネットワーク要素
WO2015149629A1 (zh) Dns行为的处理方法、装置及系统
US9197598B2 (en) MAC address distribution
US20140289193A1 (en) Synchronizing forwarding databases in a network device background
WO2016124105A1 (zh) 一种媒体接入控制地址学习方法、设备和系统
WO2016101439A1 (zh) 三态内容寻址存储器tcam空间的处理方法及装置
US20150066847A1 (en) System and method for migrating data from a source file system to a destination file system with use of attribute manipulation
WO2014201902A1 (zh) 基于tcam的查表处理方法及装置
US10554548B2 (en) Partially deferred packet access
JP2018164141A (ja) 通信装置及び通信方法
US11038798B2 (en) Storing data in association with a key within a hash table and retrieving the data from the hash table using the key
US20140351210A1 (en) Data processing system, data processing apparatus, and storage medium
WO2020119317A1 (zh) 报文转发方法及装置、存储介质、电子装置
US20160337232A1 (en) Flow-indexing for datapath packet processing
US20170118113A1 (en) System and method for processing data packets by caching instructions

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15867836

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15867836

Country of ref document: EP

Kind code of ref document: A1