WO2024001282A1 - Acl规则处理方法、装置及存储介质 - Google Patents

Acl规则处理方法、装置及存储介质 Download PDF

Info

Publication number
WO2024001282A1
WO2024001282A1 PCT/CN2023/080305 CN2023080305W WO2024001282A1 WO 2024001282 A1 WO2024001282 A1 WO 2024001282A1 CN 2023080305 W CN2023080305 W CN 2023080305W WO 2024001282 A1 WO2024001282 A1 WO 2024001282A1
Authority
WO
WIPO (PCT)
Prior art keywords
acl
acl rule
rule
rules
counter
Prior art date
Application number
PCT/CN2023/080305
Other languages
English (en)
French (fr)
Inventor
林宁
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2024001282A1 publication Critical patent/WO2024001282A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0263—Rule management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the present disclosure relates to the field of communication technology, and in particular, to an ACL rule processing method, device and storage medium.
  • ACL Access Control Lists
  • the present disclosure provides an ACL rule processing method, a control device and a storage medium, aiming to solve the technical problem of how to improve ACL resource utilization.
  • the present disclosure provides an ACL rule processing method, including: obtaining the number of packet hits for each ACL rule in a network device.
  • the number of packet hits is the number of hits of the ACL rule within one or more preset time periods.
  • the number of data packets based on the number of packet hits for each ACL rule, the invalid ACL rule is determined, and the invalid ACL rule is deleted or an alarm message is output.
  • the alarm message is used to prompt the user to delete the invalid ACL rule.
  • the present disclosure also provides a control device.
  • the control device includes a processor, a memory, a computer program stored on the memory and executable by the processor, and a data bus for realizing connection communication between the processor and the memory. , wherein when the computer program is executed by the processor, any one of the ACL rule processing methods provided in this disclosure specification is implemented.
  • the present disclosure also provides a storage medium for computer-readable storage.
  • the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the present disclosure. Instructions provided Any ACL rule processing method.
  • Figure 1 is a schematic flow chart of an ACL rule processing method provided by the present disclosure
  • Figure 2 is a schematic flow chart of another ACL rule processing method provided by the present disclosure.
  • Figure 3 is a schematic diagram of a scenario of the ACL rule set in this disclosure.
  • Figure 4 is a schematic flowchart of the sub-steps of the ACL rule processing method in Figure 2;
  • Figure 5 is a schematic diagram of a scenario of the ACL rule set and counter in the present disclosure
  • Figure 6 is a schematic structural block diagram of a control device provided by the present disclosure.
  • the present disclosure provides an ACL rule processing method, device and storage medium.
  • the ACL rule processing method can be applied to network equipment, which can include switches, routers, firewalls, bridges, hubs, gateways, virtual private network servers, network interface cards, wireless access points, modems, 5G base stations, Optical transceiver or fiber optic transceiver, etc.
  • Figure 1 is a schematic flowchart of an ACL rule processing method provided by the present disclosure.
  • the ACL rule processing method includes steps S101 to S102.
  • Step S101 Obtain the number of packet hits for each ACL rule in the network device.
  • the number of packet hits is the number of data packets hit by the ACL rule within one or more preset time periods.
  • the preset time period can be set based on actual conditions, and this disclosure does not specifically limit this. For example, if the preset time period is 1 hour, the number of packet hits can be the number of data packets hit by the ACL rule within one hour.
  • the number of packet hits recorded by the corresponding counter of each ACL rule is obtained.
  • One counter corresponds to one or more ACL rules. Among them, when a counter corresponds to an ACL rule, when the ACL rule hits a data packet, the number of packet hits recorded by the corresponding counter is incremented by 1.
  • a counter corresponds to multiple ACL rules, when the counter corresponds to When any one of the multiple ACL rules hits a data packet, the number of packet hits in the corresponding counter is incremented by 1.
  • the counter can accurately and quickly record the number of data packets that hit the ACL rule within one or more preset time periods.
  • the number of packet hits recorded by the respective matching counters of each ACL rule is obtained. It can be understood that after obtaining the number of packet hits recorded by the counters matching each ACL rule, the number of packet hits recorded by each counter can be associated and stored with the rule number of the ACL rule assigned to each counter. Then clear the number of packet hits recorded by each counter so that the counter can start recording the number of data packets hit by the ACL rule again.
  • one ACL statistical rule when one counter corresponds to one ACL rule, one ACL statistical rule is configured for the counter; when one counter corresponds to multiple ACL rules, multiple ACL statistical rules are configured for the counter.
  • the ACL statistical rule has the same packet matching conditions as the data packets hit by the ACL rule, so that the ACL statistical rule can count the number of data packets hit by the corresponding ACL rule within one or more preset time periods, and the ACL Statistics rules and ACL rules are independent of each other and will not conflict.
  • the ACL statistical rules configured for the counter after one or more preset time periods have passed, the ACL statistical rules configured for the counter are deleted.
  • the number of mirror packets corresponding to the data packet hit by each ACL rule is determined, and when any ACL rule hits the data packet, a mirror packet of the data packet is generated and stored; each ACL rule The number of mirror packets corresponding to the hit data packets is determined as the number of packet hits for each ACL rule. Among them, when any ACL rule hits a data packet, a mirrored packet of the data packet is generated, and the mirrored packet is associated with the rule number of the corresponding ACL rule. Storage, so that the number of stored mirrored packets can be queried through the rule number of the ACL rule, thereby accurately determining the number of packet hits in the ACL rule.
  • Step S102 Determine the invalid ACL rule based on the number of packet hits for each ACL rule, and delete the invalid ACL rule or output an alarm prompt information.
  • the alarm prompt information is used to prompt the user to delete the invalid ACL rule.
  • invalid ACL rules refer to ACL rules that do not hit data packets for a long time.
  • the number of packet hits of ACL rules can indicate the situation of ACL rules hitting data packets for a long time.
  • Alarm prompts The information can include the rule number of the invalid ACL rule. Users can quickly locate the invalid ACL rule through the rule number.
  • the ACL rule corresponding to the number of packet hits being zero is determined as an invalid ACL rule.
  • the number of packets matching the ACL rule corresponding to zero means that the ACL rule has not hit the data packet within one or more preset time periods, it can be determined that the ACL rule is an invalid ACL rule.
  • the number of packet hits corresponding to ACL rule A, ACL rule B, ACL rule C, ACL rule D and ACL rule E are 5, 0, 4, 0 and 20 respectively. Since ACL rule B and ACL rule D correspond to The number of packet hits is 0, then ACL rule B and ACL rule D are determined as invalid ACL rule B and ACL rule D, so that the network device can delete ACL rule B and ACL rule D.
  • the ACL rule corresponding to the number of packet hits being zero is determined as an invalid ACL rule, and the ACL rule corresponding to the number of packet hits being less than or equal to a preset quantity threshold is determined to be a suspected invalid ACL rule; Delete the invalid ACL rule, generate user prompt information based on the rule number of the suspected invalid ACL rule, and output the user prompt information.
  • the user prompt information is used to prompt the user that there is a suspected invalid ACL rule in the network device; after obtaining the user triggered When deleting an ACL rule, all suspected invalid ACL rules are deleted.
  • the preset quantity threshold can be set based on actual conditions, and this disclosure does not specifically limit this. For example, the preset quantity threshold is 1 or 2.
  • the ACL rule processing method provided in the above embodiment obtains the number of packet hits of the ACL rule, so that the invalid ACL rule can be determined based on the number of packet hits of the ACL rule, so that the invalid ACL rule can be deleted or output to prompt the user. Delete the alarm prompt information of invalid ACL rules, thereby accurately deleting invalid ACL rules, which greatly improves ACL resource utilization.
  • Figure 2 is a schematic flowchart of another ACL rule processing method provided by the present disclosure.
  • the ACL rule processing method includes steps S201 to S206.
  • Step S201 Obtain the number of counters of the network device and the number of ACL rules of the ACL rule set in the network device.
  • the number of counters in the network device is the number of counters in the network device
  • the ACL rule set is all the ACL rules configured in the network device
  • the number of ACL rules in the ACL rule set is the number of ACL rules in the ACL rule set.
  • Step S202 When the number of counters is greater than or equal to the number of ACL rules, assign a counter to each ACL rule in the ACL rule set.
  • a counter can be assigned to each ACL rule in the ACL rule set. In this way, a counter can accurately record the number of data packets that hit an ACL rule, which can increase the number of packet hits. accuracy.
  • Step S203 When the number of counters is less than the number of ACL rules, multiple ACL rules are allocated to each counter until all ACL rules in the ACL rule set are allocated.
  • ACL rule set 10 includes ACL rule 11, ACL rule 12, ACL rule 13, ACL rule 14, ACL rule 15, ACL rule 16, ACL rule 17, ACL rule 18 and ACL rule 19, counter Including counter N 1 and counter N 2 , counter N 1 can be assigned ACL rule 11, ACL rule 12, ACL rule 17 and ACL rule 19 in ACL rule set 10, and counter N 2 can be assigned an ACL in ACL rule set 10.
  • a packet hit number counting instruction is detected; when the packet hit number counting instruction is detected, the number of counters of the network device and the number of ACL rules of the ACL rule set in the network device are obtained; when the number of counters is greater than or equal to When the number of ACL rules is smaller than the number of ACL rules, assign a counter to each ACL rule in the ACL rule set; when the number of counters is less than the number of ACL rules, assign multiple ACL rules to each counter until all ACL rules in the ACL rule set are allocated.
  • the packet hit number counting instruction can be manually triggered by the user or can be triggered regularly. For example, after one or more preset time periods, the packet hitting number counting instruction is triggered.
  • step S203 includes: sub-steps S2031 to sub-step S2032.
  • Sub-step S2031 Divide the ACL rules in the ACL rule set into multiple ACL rule groups.
  • Sub-step S2032 Assign a counter to each ACL rule group.
  • the ACL rule group includes multiple ACL rules.
  • the number of ACL rule groups is less than or equal to the number of counters.
  • the ACL rule group can be divided based on the type of each ACL rule or the IP address within each ACL rule. It can also be divided according to the ACL rule.
  • the ACL rules can be divided according to the order in the set, or randomly.
  • the type of each ACL rule in the ACL rule set is obtained, and ACL rules of the same type are divided into one ACL rule group to obtain multiple ACL rule groups.
  • the types of ACL rules can include basic ACL, advanced ACL, Layer 2 ACL, user ACL, etc.
  • ACL rules of the basic ACL type are divided into ACL rule group G 1
  • ACL rules of the advanced ACL type are divided into ACL rule group G 2
  • ACL rules of the Layer 2 ACL type are divided into ACL rule group G 3 , divide the ACL rules of type user ACL into ACL rule group G 4 .
  • Such a counter can record the number of data packets hit by the same type of ACL rules, and the number of packet hits recorded by the counter can be increased. Quantity accuracy.
  • the IP address in each ACL rule in the ACL rule set is determined, and the ACL rules whose IP addresses are in the same network segment are divided into one ACL rule group to obtain multiple ACL rule groups.
  • a counter can record the number of data packets that hit the ACL rule in the same network segment, which can improve the accuracy of the number of packet hits recorded by the counter.
  • the IP address may include a source IP address and/or a destination IP address.
  • the source IP address in each ACL rule in the ACL rule set is determined, and the ACL rules whose source IP addresses are in the same network segment are divided into one ACL rule group to obtain multiple ACL rule groups.
  • determine the target IP address in each ACL rule in the ACL rule set and divide the ACL rules whose target IP addresses are in the same network segment into one ACL rule group to obtain multiple ACL rule groups.
  • determine the source IP address and destination IP address in each ACL rule in the ACL rule set and divide the ACL rules whose source IP address is in the same network segment and destination IP address is in the same network segment into an ACL rule group to get Multiple ACL rule groups.
  • the number of ACL rules is divided by the number of counters to obtain the target number of ACL rules assigned to each counter, and the ACL rules in the ACL rule set are divided into multiple ACL rules according to the target number. Group. Among them, you can select the target number of ACL rules from the ACL rule set as an ACL rule group according to the order of the ACL rules in the ACL rule set, or you can randomly select the target number of ACL rules from the ACL rule set each time. number of ACL rules as an ACL rule group. Through the above method, it can be ensured that the number of ACL rules contained in the divided ACL rule groups has a small difference, so that the counter can record the number of data packets matching the ACL rules in a balanced manner.
  • ACL rule set 10 includes ACL rule 11, ACL rule 12, ACL rule 13, ACL rule 14, ACL rule 15, ACL rule 16, ACL rule 17, ACL rule 18 and ACL rule 19, counter The number is 3, then the target number is 3.
  • 3 ACL rules are selected from the ACL rule set 10 as an ACL rule group each time, thus obtaining ACL rules including ACL rules 11,
  • the first ACL rule group of ACL rule 12 and ACL rule 13 includes ACL rule 14, ACL rule 15 and ACL rule A second ACL rule group of 16 and a third ACL rule group including ACL rule 17, ACL rule 18 and ACL rule 19.
  • the number of counters when the number of counters is less than the number of ACL rules, multiple ACL rules matching the number of counters are selected from the ACL rule set each time, and a counter is assigned to each selected ACL rule; after one or more After a preset time period, the number of packet hits recorded by each counter is associated and stored with the rule number of the ACL rule assigned to each counter; the number of packet hits recorded by each counter is cleared until the ACL rule collection Each ACL rule in is selected once.
  • the number of packet hits for each ACL rule can be accurately determined based on the above polling method.
  • the ACL rule set 20 includes ACL rule 21 , ACL rule 22 , ACL rule 23 , ACL rule 24 , ACL rule 25 , ACL rule 26 , ACL rule 27 and ACL rule 28 , and the counter includes counter 31 and counter 32, you can select ACL rule 21 and ACL rule 22, assign counter 31 to ACL rule 21, and assign counter 32 to ACL rule 22, so that after one or more preset time periods, counter 31 records The number of packet hits of ACL rule 21 is recorded in counter 32. Therefore, the number of packet hits recorded by counter 31 is associated with the rule number of ACL rule 21 and stored, and the number of packet hits recorded by counter 32 is stored.
  • the number of packet hits is stored in association with the rule number of ACL rule 22, and then the number of packet hits recorded in counter 31 and counter 32 is cleared.
  • counter 31 and counter 32 can be reassigned to the ACL rule set 20 ACL rules until each ACL rule in the ACL rule set 20 is selected once, so that the number of packet hits for each ACL rule in the ACL rule set 20 can be determined.
  • Step S204 Obtain the number of packet hits recorded by the counters matching each ACL rule.
  • the number of packet hits recorded in the counter corresponding to the ACL rule group is incremented by 1.
  • the ACL rule group corresponds to counter N 3.
  • the ACL rule group includes ACL rule A, ACL rule B, ACL rule C and ACL rule D.
  • ACL rule A hits a data packet
  • the packet recorded in counter N 3 hits The number is increased by 1.
  • ACL rule C hits a data packet
  • the number of packet hits recorded in counter N 3 is also increased by 1.
  • counter N 3 records The number of packet hits is also increased by 1.
  • the number of packet hits of the ACL rule is the value recorded by the counter
  • the number of hits in the multiple ACL rules The number of packet hits for each ACL rule is the value recorded by the corresponding counter.
  • ACL rule A corresponds to counter A
  • the value recorded by counter A is 8
  • the number of packet hits for ACL rule A is 8.
  • ACL rule B, ACL rule C and ACL rule D correspond to counter B, and the value recorded by counter B is 0, then the ACL
  • the number of packet hits for rule B, ACL rule C, and ACL rule D are all 0.
  • Step S205 Determine the invalid ACL rule based on the number of packet hits for each ACL rule, and delete the invalid ACL rule or output an alarm prompt information.
  • the alarm prompt information is used to prompt the user to delete the invalid ACL rule.
  • the number of packet hits recorded in the counter of each ACL rule group matching is obtained; all ACL rules in the ACL rule group corresponding to zero packet hits are determined as invalid ACL rules, and the invalid ACL rules are deleted.
  • ACL rules determine all ACL rules in the ACL rule group corresponding to a non-zero number of packet hits as ACL rules to be filtered; each time select multiple ACL rules to be filtered that match the number of counters, and give each selected A counter is assigned to the ACL rule to be filtered; after one or more preset time periods, the number of packet hits recorded by each counter is associated and stored with the rule number of the ACL rule to be filtered assigned by each counter; for each The number of packet hits recorded in the counter is cleared until each ACL rule to be filtered is selected once; the number of packet hits for each ACL rule to be filtered is obtained, and the ACL to be filtered corresponding to the number of packet hits is zero The rule is determined to be an invalid ACL rule, and the invalid ACL rule is deleted.
  • the ACL rule processing method obtains the number of counters and the number of ACL rules, and when the number of counters is greater than or equal to the number of ACL rules, allocates a counter to each ACL rule in the ACL rule set, and when the number of counters is less than When specifying the number of ACL rules, assign multiple ACL rules to each counter until all ACL rules in the ACL rule set are allocated. In this way, the number of packet hits for each ACL rule can be quickly counted, and the number of packet hits based on the ACL rule can be quickly counted. Quantity, determine the invalid ACL rules, so that the invalid ACL rules can be deleted or an alarm message is output to prompt the user to delete the invalid ACL rules, so that the invalid ACL rules can be accurately deleted, which greatly improves the utilization of ACL resources.
  • FIG. 6 is a schematic structural block diagram of a control device provided by the present disclosure.
  • control device 300 includes a processor 301 and a memory 302.
  • the processor 301 and the memory 302 are connected through a bus 303, which is, for example, an I2C (Inter-integrated Circuit) bus.
  • I2C Inter-integrated Circuit
  • the processor 301 is used to provide computing and control capabilities to support the operation of the entire control device 300 .
  • the processor 301 can be a central processing unit (Central Processing Unit, CPU).
  • the processor 301 can also be other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), or application-specific integrated circuits. (Application Specific Integrated Circuit, ASIC), Field-Programmable Gate Array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • the general processor may be a microprocessor or the processor may be any conventional processor.
  • the memory 302 may be a Flash chip, a read-only memory (ROM, Read-Only Memory) disk, an optical disk, a USB disk, a mobile hard disk, or the like.
  • ROM read-only memory
  • the memory 302 may be a Flash chip, a read-only memory (ROM, Read-Only Memory) disk, an optical disk, a USB disk, a mobile hard disk, or the like.
  • FIG. 6 is only a block diagram of a partial structure related to the disclosed solution, and does not constitute a limitation on the control device to which the disclosed solution is applied.
  • the specific control device can May include more or fewer parts than shown, or combine certain parts, or have a different arrangement of parts.
  • the processor 301 is used to run a computer program stored in the memory 302, and implement any of the ACL rule processing methods provided by this disclosure when executing the computer program.
  • the processor 301 is configured to run a computer program stored in the memory 302, and implement the following steps when executing the computer program: obtain the number of packet hits for each ACL rule in the network device, the number of packet hits It is the number of data packets hit by ACL rules within one or more preset time periods; based on the number of packet hits for each ACL rule, the invalid ACL rules are determined, and the invalid ACL rules are deleted or alarm prompts are output. Alarm prompts are used to prompt users to delete invalid ACL rules.
  • the processor 301 when obtaining the number of packet hits for each ACL rule in the network device, is configured to: obtain the number of packet hits recorded by the counters matching each ACL rule.
  • One counter corresponds to One or more ACL rules.
  • the processor 301 before obtaining the number of packet hits recorded by the counters matching each ACL rule, is also configured to: obtain the number of counters of the network device and the ACL rules of the ACL rule set in the network device. Quantity; when the number of counters is greater than or equal to the number of ACL rules, assign a counter to each ACL rule in the ACL rule set; when the number of counters is less than the number of ACL rules, assign multiple ACL rules to each counter until the ACL rule set The ACL rules in have been assigned.
  • the processor 301 when allocating multiple ACL rules to each counter, is configured to: divide the ACL rules in the ACL rule set into multiple ACL rule groups, and the number of ACL rule groups is less than or equal to Number of counters; assign a counter to each ACL rule group, and the ACL rule group includes multiple ACL rules.
  • the processor 301 when the processor 301 divides the ACL rules in the ACL rule set into multiple ACL rule groups, the processor 301 is configured to: obtain the type of each ACL rule in the ACL rule set, and divide the ACL rules of the same type into Divide ACL rules into an ACL rule group to obtain multiple ACL rule groups; or, determine each ACL in the ACL rule set IP addresses in the rules, and divide ACL rules with IP addresses in the same network segment into one ACL rule group to obtain multiple ACL rule groups; or divide the number of ACL rules by the number of counters to obtain the ACL rules assigned to each counter.
  • the target number of rules, and divide the ACL rules in the ACL rule set into multiple ACL rule groups according to the target number.
  • the processor 301 is also configured to: when the number of counters is less than the number of ACL rules, obtain the number of counters from the ACL rule each time. Select multiple ACL rules from the set that match the number of counters, and assign a counter to each selected ACL rule; after one or more preset time periods, the number of packet hits recorded by each counter is compared with the number of packet hits for each The rule number of the ACL rule assigned by the counter is stored in association; the number of packet hits recorded by each counter is cleared until each ACL rule in the ACL rule set is selected once.
  • the processor 301 when obtaining the number of packet hits for each ACL rule in the network device, is configured to: determine the number of mirror packets corresponding to the data packets hit by each ACL rule. When an ACL rule hits a data packet, a mirror packet of the data packet is generated and stored; the number of mirror packets corresponding to the data packet hit by each ACL rule is determined as the number of packet hits for each ACL rule.
  • the processor 301 when determining an invalid ACL rule based on the number of packet hits for each ACL rule, the processor 301 is configured to: determine the ACL rule corresponding to a zero packet hit number as an invalid ACL. rule.
  • control device 300 can be applied in network equipment.
  • the present disclosure also provides a storage medium for computer-readable storage.
  • the storage medium stores one or more programs.
  • the one or more programs can be executed by one or more processors to implement any of the tasks provided by the present disclosure.
  • An ACL rule processing method An ACL rule processing method.
  • the storage medium may be an internal storage unit of the network management device described in the previous embodiment, such as a hard disk or memory of the network management device.
  • the storage medium can also be an external storage device of the network management device, such as a plug-in hard disk, smart memory card (SMC), secure digital (SD) card, and flash card (Flash Card) equipped on the network management device. wait.
  • SMC smart memory card
  • SD secure digital
  • Flash Card flash card
  • the present disclosure provides an ACL rule processing method, a control device and a storage medium.
  • the ACL rule processing method obtains the number of packet hits of the ACL rule, so that the invalid ACL rule can be determined based on the number of packet hits of the ACL rule. Deleting invalid ACL rules or outputting alarm information to prompt users to delete invalid ACL rules can accurately delete invalid ACL rules and greatly improve ACL resource utilization.
  • Such software may be distributed on computer-readable media, which may include computer storage media (or non-transitory media) and communication media (or transitory media).
  • computer storage media includes volatile and nonvolatile media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. removable, removable and non-removable media.
  • Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, Digital Versatile Disk (DVD) or other optical disk storage, magnetic cassettes, tapes, disk storage or other magnetic storage devices, or may Any other medium used to store the desired information and that can be accessed by a computer.
  • communication media typically embodies computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • General Business, Economics & Management (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本公开提供一种ACL规则处理方法、装置及存储介质，属于通信领域。该方法包括：获取网络设备中的每个ACL规则的报文命中数量；根据每个ACL规则的报文命中数量，确定失效的ACL规则，并删除失效的ACL规则或者输出告警提示信息，告警提示信息用于提示用户删除失效的ACL规则。

Description

ACL规则处理方法、装置及存储介质
相关申请的交叉引用
本公开要求享有2022年06月29日提交的名称为“ACL规则处理方法、装置及存储介质”的中国专利申请CN202210753196.6的优先权，其全部内容通过引用并入本公开中。
技术领域
本公开涉及通信技术领域，尤其涉及一种ACL规则处理方法、装置及存储介质。
背景技术
目前，交互机或路由器等网络设备通常配置有访问控制列表(Access Control Lists，ACL)，通过ACL可以对接口上的数据报文进行过滤，允许数据报文通过或丢弃。然而，ACL配置完成后，通常是长期生效的，如果需要删除ACL，则需要网管人员通过ACL命令或者网关进行手动删除，无法准确地删除失效的ACL规则，容易出现误删，并且没有删除的失效的ACL规则会占用大量的ACL资源。因此，如何提高ACL资源利用率是目前亟待解决的问题。
发明内容
本公开提供了一种ACL规则处理方法、控制装置及存储介质，旨在解决如何提高ACL资源利用率的技术问题。
第一方面，本公开提供一种ACL规则处理方法，包括：获取网络设备中的每个ACL规则的报文命中数量，报文命中数量为ACL规则在一个或多个预设时间周期内命中的数据报文的数量；根据每个ACL规则的报文命中数量，确定失效的ACL规则，并删除失效的ACL规则或者输出告警提示信息，告警提示信息用于提示用户删除失效的ACL规则。
第二方面，本公开还提供一种控制装置，控制装置包括处理器、存储器、存储在存储器上并可被处理器执行的计算机程序以及用于实现处理器和存储器之间的连接通信的数据总线，其中所述计算机程序被处理器执行时，实现如本公开说明书提供的任一项ACL规则处理方法。
第三方面，本公开还提供一种存储介质，用于计算机可读存储，存储介质存储有一个或者多个程序，一个或者多个程序可被一个或者多个处理器执行，以实现如本公开说明书提供 的任一项ACL规则处理方法。
附图说明
为了更清楚地说明本公开技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图是本公开的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本公开提供的一种ACL规则处理方法的流程示意图；
图2是本公开提供的另一种ACL规则处理方法的流程示意图；
图3是本公开中的ACL规则集合的一场景示意图；
图4是图2中的ACL规则处理方法的子步骤流程示意图；
图5是本公开中的ACL规则集合和计数器的一场景示意图；
图6为本公开提供的一种控制装置的结构示意框图。
具体实施方式
下面将结合本公开中的附图，对本公开中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本公开的一部分实施例，而不是全部的实施例。基于本公开中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本公开保护的范围。
附图中所示的流程图仅是示例说明，不是必须包括所有的内容和操作/步骤，也不是必须按所描述的顺序执行。例如，有的操作/步骤还可以分解、组合或部分合并，因此实际执行的顺序有可能根据实际情况改变。
应当理解，在此本公开说明书中所使用的术语仅仅是出于描述特定实施例的目的而并不意在限制本公开。如在本公开说明书和所附权利要求书中所使用的那样，除非上下文清楚地指明其它情况，否则单数形式的“一”、“一个”及“该”意在包括复数形式。
本公开提供一种ACL规则处理方法、装置及存储介质。其中，该ACL规则处理方法可应用于网络设备，该网络设备可以包括交换机、路由器、防火墙、网桥、集线器、网关、虚拟专用网络服务器、网络接口卡、无线接入点、调制解调器、5G基站、光端机或光纤收发器等。
下面结合附图，对本公开的一些实施例作详细说明。在不冲突的情况下，下述的实施例及实施例中的特征可以相互组合。
请参阅图1，图1是本公开提供的一种ACL规则处理方法的流程示意图。
如图1所示，该ACL规则处理方法包括步骤S101至步骤S102。
步骤S101、获取网络设备中的每个ACL规则的报文命中数量。
其中，该报文命中数量为ACL规则在一个或多个预设时间周期内命中的数据报文的数量，预设时间周期可以基于实际情况进行设置，本公开对此不做具体限定。例如，预设时间周期为1小时，则该报文命中数量可以为ACL规则在一小时内命中的数据报文的数量。
在一实施例中，获取每个ACL规则各自匹配的计数器记录的报文命中数量，一个计数器对应一个或多个ACL规则。其中，在一个计数器对应一个ACL规则的情况下，在ACL规则命中一个数据报文时，对应的计数器记录的报文命中数量加1，在一个计数器对应多个ACL规则的情况下，在计数器对应的多个ACL规则中的任一个ACL规则命中数据报文时，对应计数器的报文命中数量加1。通过计数器可以准确快速地记录ACL规则在一个或多个预设时间周期内命中的数据报文的数量。
在一示例性实施例中，在间隔一个或多个预设时间周期后，获取每个ACL规则各自匹配的计数器记录的报文命中数量。可以理解的是，在获取到每个ACL规则各自匹配的计数器记录的报文命中数量后，可以将每个计数器记录的报文命中数量与每个计数器分配的ACL规则的规则编号进行关联存储，然后对每个计数器记录的报文命中数量进行清零，使得计数器可以重新开始记录ACL规则命中的数据报文的数量。
在一示例性实施例中，在一个计数器对应一个ACL规则的情况下，给计数器配置一个ACL统计规则；在一个计数器对应多个ACL规则的情况下，给计数器配置多个ACL统计规则。其中，该ACL统计规则与ACL规则命中数据报文的报文匹配条件相同，这样ACL统计规则能够统计对应的ACL规则在一个或多个预设时间周期内命中的数据报文的数量，并且ACL统计规则与ACL规则相互独立，不会冲突。其中，在经过一个或多个预设时间周期后，删除给计数器配置的ACL统计规则。
在一实施例中，确定每个ACL规则命中的数据报文对应的镜像报文的数量，在任一ACL规则命中数据报文时，生成并存储数据报文的镜像报文；将每个ACL规则命中的数据报文对应的镜像报文的数量确定为每个ACL规则的报文命中数量。其中，在任一ACL规则命中数据报文时，生成数据报文的镜像报文，并将镜像报文与对应的ACL规则的规则编号进行关联 存储，这样可以通过ACL规则的规则编号查询存储的镜像报文的数量，从而准确地确定ACL规则的报文命中数量。
步骤S102、根据每个ACL规则的报文命中数量，确定失效的ACL规则，并删除失效的ACL规则或者输出告警提示信息，告警提示信息用于提示用户删除失效的ACL规则。
其中，失效的ACL规则是指在长时间的情况下没有命中数据报文的ACL规则，通过ACL规则的报文命中数量可以表征ACL规则在长时间的情况下命中数据报文的情况，告警提示信息可以包括失效的ACL规则的规则编号，用户可以通过规则编号快速定位失效的ACL规则。
在一示例性实施例中，将报文命中数量为零所对应的ACL规则确定为失效的ACL规则。其中，报文命中数量为零对应的ACL规则，则表示该ACL规则在一个或多个预设时间周期内没有命中的数据报文，从而可以确定该ACL规则为失效的ACL规则。例如，ACL规则A、ACL规则B、ACL规则C、ACL规则D和ACL规则E各自对应的报文命中数量分别为5、0、4、0、和20，由于ACL规则B和ACL规则D对应的报文命中数量均为0，则将ACL规则B和ACL规则D确定为失效的ACL规则B和ACL规则D，这样网络设备可以删除ACL规则B和ACL规则D。
在一实施例中，将报文命中数量为零所对应的ACL规则确定为失效的ACL规则，并将报文命中数量小于或等于预设数量阈值所对应的ACL规则确定为疑似失效ACL规则；删除失效的ACL规则，并根据疑似失效ACL规则的规则编号，生成用户提示信息，且输出用户提示信息，该用户提示信息用于提示用户网络设备中存在疑似失效ACL规则；在获取到用户触发的ACL规则删除指令时，删除全部疑似失效ACL规则。其中，预设数量阈值可以基于实际情况进行设置，本公开对此不做具体限定。例如，预设数量阈值为1或2。通过确定疑似失效ACL规则，并输出用户提示信息，这样可以由用户自己确认是否删除疑似失效ACL规则，能够避免误删除生效的ACL规则。
上述实施例提供的ACL规则处理方法，通过获取ACL规则的报文命中数量，这样能够基于ACL规则的报文命中数量，确定失效的ACL规则，从而可以删除失效的ACL规则或者输出用于提示用户删除失效的ACL规则的告警提示信息，进而能够准确地删除失效的ACL规则，极大地提高了ACL资源利用率。
请参阅图2，图2是本公开提供的另一种ACL规则处理方法的流程示意图。
如图2所示，该ACL规则处理方法包括步骤S201至S206。
步骤S201、获取网络设备的计数器数量和网络设备中的ACL规则集合的ACL规则数量。
其中，网络设备的计数器数量为网络设备中的计数器的数量，ACL规则集合为网络设备中已配置的全部ACL规则，ACL规则集合的ACL规则数量为ACL规则集合中的ACL规则的数量。
步骤S202、在计数器数量大于或等于ACL规则数量时，给ACL规则集合中的每个ACL规则分配一个计数器。
通过在计数器数量大于或等于ACL规则数据时，可以给ACL规则集合中的每个ACL规则分配一个计数器，这样一个计数器能够准确地记录一个ACL规则命中数据报文的数量，可以提高报文命中数量的准确性。
步骤S203、在计数器数量小于ACL规则数量时，给每个计数器分配多个ACL规则，直至ACL规则集合中的ACL规则被分配完。
其中，一个计数器对应多个ACL规则的情况下，在计数器对应的多个ACL规则中的任一个ACL规则命中数据报文时，对应计数器的报文命中数量加1。例如，如图3所示，ACL规则集合10包括ACL规则11、ACL规则12、ACL规则13、ACL规则14、ACL规则15、ACL规则16、ACL规则17、ACL规则18和ACL规则19，计数器包括计数器N1和计数器N2，则可以给计数器N1分配ACL规则集合10中的ACL规则11、ACL规则12、ACL规则17和ACL规则19，给计数器N2分配ACL规则集合10中的ACL规则13、ACL规则14、ACL规则15、ACL规则16和ACL规则18。
在一实施例中，检测报文命中数量统计指令；在检测到报文命中数量统计指令时，获取网络设备的计数器数量和网络设备中的ACL规则集合的ACL规则数量；在计数器数量大于或等于ACL规则数量时，给ACL规则集合中的每个ACL规则分配一个计数器；在计数器数量小于ACL规则数量时，给每个计数器分配多个ACL规则，直至ACL规则集合中的ACL规则被分配完。其中，报文命中数量统计指令可以由用户手动触发，也可以定时触发，例如，在经过一个或多个预设时间周期后，触发报文命中数量统计指令。
在一实施例中，如图4所示，步骤S203包括：子步骤S2031至子步骤S2032。
子步骤S2031，将ACL规则集合中的ACL规则划分为多个ACL规则组。子步骤S2032、给每个ACL规则组分配一个计数器。
其中，ACL规则组包括多个ACL规则，ACL规则组的数量小于或等于计数器数量，ACL规则组可以基于每个ACL规则的类型或每个ACL规则内的IP地址进行划分，也可以按照ACL规则在ACL规则集合中的顺序进行划分，还可以随机地进行划分。
在一示例性实施例中，获取ACL规则集合中的每个ACL规则的类型，并将类型相同的ACL规则划分为一个ACL规则组，得到多个ACL规则组。其中，ACL规则的类型可以包括基本ACL、高级ACL、二层ACL和用户ACL等。例如，将类型为基本ACL的ACL规则划分为ACL规则组G1，将类型为高级ACL的ACL规则划分为ACL规则组G2，将类型为二层ACL的ACL规则划分为ACL规则组G3，将类型为用户ACL的ACL规则划分为ACL规则组G4。通过将类型相同的ACL规则划分为一个ACL规则组，并给每个ACL规则组分配一个计数器，这样一个计数器可以记录相同类型的ACL规则命中数据报文的数量，可以提高计数器记录的报文命中数量的准确性。
在一示例性实施例中，确定ACL规则集合中的每个ACL规则内的IP地址，并将IP地址处于相同网段的ACL规则划分为一个ACL规则组，得到多个ACL规则组。通过将IP地址处于相同网段的ACL规则划分为一个ACL规则组，这样一个计数器可以记录相同网段ACL规则命中数据报文的数量，可以提高计数器记录的报文命中数量的准确性。
在一示例性实施例中，IP地址可以包括源IP地址和/或目标IP地址。在一示例性实施例中，确定ACL规则集合中的每个ACL规则内的源IP地址，并将源IP地址处于相同网段的ACL规则划分为一个ACL规则组，得到多个ACL规则组。或者，确定ACL规则集合中的每个ACL规则内的目标IP地址，并将目标IP地址处于相同网段的ACL规则划分为一个ACL规则组，得到多个ACL规则组。或者确定ACL规则集合中的每个ACL规则内的源IP地址和目标IP地址，并将源IP地址处于相同网段，且目标IP地址处于相同网段的ACL规则划分为一个ACL规则组，得到多个ACL规则组。
在一示例性实施例中，用ACL规则数量除以计数器数量，得到给每个计数器分配ACL规则的目标条数，并按照目标条数，将ACL规则集合中的ACL规则划分为多个ACL规则组。其中，可以按照ACL规则在ACL规则集合中的顺序，每次从ACL规则集合中选择该目标条数的ACL规则作为一个ACL规则组，也可以随机地每次从ACL规则集合中选择该目标条数的ACL规则作为一个ACL规则组。通过上述方式，可以保证划分出来的ACL规则组包含的ACL规则的数量相差较小，使得计数器可以均衡的记录ACL规则命中数据报文的数量。
例如，如图3所示，ACL规则集合10包括ACL规则11、ACL规则12、ACL规则13、ACL规则14、ACL规则15、ACL规则16、ACL规则17、ACL规则18和ACL规则19，计数器数量为3个，则目标条数为3，则按照ACL规则在ACL规则集合中的顺序，每次从ACL规则集合10中选择3条ACL规则作为一个ACL规则组，从而得到包括ACL规则11、ACL规则12和ACL规则13的第一ACL规则组、包括ACL规则14、ACL规则15和ACL规则 16的第二ACL规则组以及包括ACL规则17、ACL规则18和ACL规则19的第三ACL规则组。
在一实施例中，在计数器数量小于ACL规则数量时，每次从ACL规则集合中选择与计数器数量匹配的多个ACL规则，并给选择的每个ACL规则分配一个计数器；在经过一个或多个预设时间周期后，将每个计数器记录的报文命中数量与每个计数器分配的ACL规则的规则编号进行关联存储；对每个计数器记录的报文命中数量进行清零，直至ACL规则集合中的每个ACL规则均被选择一次。通过在计数器数量小于ACL规则数量时，基于上述轮询的方式可以准确地确定每个ACL规则的报文命中数量。
例如，如图5所示，ACL规则集合20包括ACL规则21、ACL规则22、ACL规则23、ACL规则24、ACL规则25、ACL规则26、ACL规则27和ACL规则28，而计数器包括计数器31和计数器32，则可以选择ACL规则21和ACL规则22，并给ACL规则21分配计数器31，且给ACL规则22分配计数器32，这样在经过一个或多个预设时间周期后，计数器31记录有ACL规则21的报文命中数量，计数器32记录有ACL规则22的报文命中数量，因此将计数器31记录的报文命中数量与ACL规则21的规则编号进行关联存储，且将计数器32记录的报文命中数量与ACL规则22的规则编号进行关联存储，然后对计数器31和计数器32记录的报文命中数量进行清零，按照类似的方式，可以重新给计数器31和计数器32分配ACL规则集合20中的ACL规则，直到ACL规则集合20中的每个ACL规则均被选择一次，从而可以确定ACL规则集合20中的每个ACL规则的报文命中数量。
步骤S204、获取每个ACL规则各自匹配的计数器记录的报文命中数量。
其中，在ACL规则组中的任一ACL规则命中数据报文时，该ACL规则组对应的计数器记录的报文命中数量加1。例如，ACL规则组与计数器N3对应，ACL规则组包括ACL规则A、ACL规则B、ACL规则C和ACL规则D，在ACL规则A命中一个数据报文时，计数器N3记录的报文命中数量加1，而在ACL规则C命中一个数据报文时，计数器N3记录的报文命中数量也加1，同样的，ACL规则B或ACL规则D命中一个数据报文时，计数器N3记录的报文命中数量也加1。
可以理解的是，在一个计数器对应一个ACL规则的情况下，ACL规则的报文命中数量即为计数器记录的数值，而在一个计数器对应多个ACL规则的情况下，这多个ACL规则中的每个ACL规则的报文命中数量均为对应计数器记录的数值。例如，ACL规则A与计数器A对应，且计数器A记录的数值为8，则ACL规则A的报文命中数量为8。又例如，ACL规则B、ACL规则C和ACL规则D与计数器B对应，且计数器B记录的数值为0，则ACL 规则B、ACL规则C和ACL规则D的报文命中数量均为0。
步骤S205、根据每个ACL规则的报文命中数量，确定失效的ACL规则，并删除失效的ACL规则或者输出告警提示信息，告警提示信息用于提示用户删除失效的ACL规则。
其中，由于在一个计数器对应一个ACL规则组的情况下，在计数器对应的多个ACL规则中的任一个ACL规则命中数据报文时，对应计数器的报文命中数量加1，这样会存在计数器记录的报文命中数量不为零，但对应的ACL规则组中存在失效的ACL规则，但失效的ACL规则无法被准确识别，因此，需要进一步地确定失效的ACL规则。
在一实施例中，获取每个ACL规则组匹配的计数器记录的报文命中数量；将报文命中数量为零所对应的ACL规则组中的全部ACL规则确定为失效的ACL规则，并删除失效的ACL规则；将报文命中数量不为零对应的ACL规则组中的全部ACL规则确定为待筛选ACL规则；每次选择与计数器数量匹配的多个待筛选ACL规则，并给选择的每个待筛选ACL规则分配一个计数器；在经过一个或多个预设时间周期后，将每个计数器记录的报文命中数量与每个计数器分配的待筛选ACL规则的规则编号进行关联存储；对每个计数器记录的报文命中数量进行清零，直至每个待筛选ACL规则均被选择一次；获取每个待筛选ACL规则的报文命中数量，并将报文命中数量为零所对应的待筛选ACL规则确定为失效的ACL规则，并删除失效的ACL规则。通过分组与轮询的方式，可以准确且快速地完成对所有ACL规则的失效进行判断，提高判断效率。
上述实施例提供的ACL规则处理方法，通过获取计数器数量和ACL规则数量，并在计数器数量大于或等于ACL规则数量时，给ACL规则集合中的每个ACL规则分配一个计数器，而在计数器数量小于ACL规则数量时，给每个计数器分配多个ACL规则，直至ACL规则集合中的ACL规则被分配完，这样可以快速地统计每个ACL规则的报文命中数量，能够基于ACL规则的报文命中数量，确定失效的ACL规则，从而可以删除失效的ACL规则或者输出用于提示用户删除失效的ACL规则的告警提示信息，进而能够准确地删除失效的ACL规则，极大地提高了ACL资源利用率。
请参阅图6，图6是本公开提供的一种控制装置的结构示意性框图。
如图6所示，控制装置300包括处理器301和存储器302，处理器301和存储器302通过总线303连接，该总线比如为I2C(Inter-integrated Circuit)总线。
在一示例性实施例中，处理器301用于提供计算和控制能力，支撑整个控制装置300的运行。处理器301可以是中央处理单元(Central Processing Unit，CPU)，该处理器301还可以是其他通用处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路 (Application Specific Integrated Circuit，ASIC)、现场可编程门阵列(Field-Programmable Gate Array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。其中，通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
在一示例性实施例中，存储器302可以是Flash芯片、只读存储器(ROM，Read-Only Memory)磁盘、光盘、U盘或移动硬盘等。
本领域技术人员可以理解，图6中示出的结构，仅仅是与本公开方案相关的部分结构的框图，并不构成对本公开方案所应用于其上的控制装置的限定，具体的控制装置可以包括比图中所示更多或更少的部件，或者组合某些部件，或者具有不同的部件布置。
其中，处理器301用于运行存储在存储器302中的计算机程序，并在执行计算机程序时实现本公开提供的任意一种所述的ACL规则处理方法。
在一实施例中，处理器301用于运行存储在存储器302中的计算机程序，并在执行计算机程序时实现以下步骤：获取网络设备中的每个ACL规则的报文命中数量，报文命中数量为ACL规则在一个或多个预设时间周期内命中的数据报文的数量；根据每个ACL规则的报文命中数量，确定失效的ACL规则，并删除失效的ACL规则或者输出告警提示信息，告警提示信息用于提示用户删除失效的ACL规则。
在一实施例中，处理器301在实现获取网络设备中的每个ACL规则的报文命中数量时，用于实现：获取每个ACL规则各自匹配的计数器记录的报文命中数量，一个计数器对应一个或多个ACL规则。
在一实施例中，处理器301在实现获取每个ACL规则各自匹配的计数器记录的报文命中数量之前，还用于实现：获取网络设备的计数器数量和网络设备中的ACL规则集合的ACL规则数量；在计数器数量大于或等于ACL规则数量时，给ACL规则集合中的每个ACL规则分配一个计数器；在计数器数量小于ACL规则数量时，给每个计数器分配多个ACL规则，直至ACL规则集合中的ACL规则被分配完。
在一实施例中，处理器301在实现给每个计数器分配多个ACL规则时，用于实现：将ACL规则集合中的ACL规则划分为多个ACL规则组，ACL规则组的数量小于或等于计数器数量；给每个ACL规则组分配一个计数器，ACL规则组包括多个ACL规则。
在一实施例中，处理器301在实现将ACL规则集合中的ACL规则划分为多个ACL规则组时，用于实现：获取ACL规则集合中的每个ACL规则的类型，并将类型相同的ACL规则划分为一个ACL规则组，得到多个ACL规则组；或者，确定ACL规则集合中的每个ACL 规则内的IP地址，并将IP地址处于相同网段的ACL规则划分为一个ACL规则组，得到多个ACL规则组；或者，用ACL规则数量除以计数器数量，得到给每个计数器分配ACL规则的目标条数，并按照目标条数，将ACL规则集合中的ACL规则划分为多个ACL规则组。
在一实施例中，处理器301在实现获取网络设备的计数器数量和网络设备中的ACL规则集合的ACL规则数量之后，还用于实现：在计数器数量小于ACL规则数量时，每次从ACL规则集合中选择与计数器数量匹配的多个ACL规则，并给选择的每个ACL规则分配一个计数器；在经过一个或多个预设时间周期后，将每个计数器记录的报文命中数量与每个计数器分配的ACL规则的规则编号进行关联存储；对每个计数器记录的报文命中数量进行清零，直至ACL规则集合中的每个ACL规则均被选择一次。
在一实施例中，处理器301在实现获取网络设备中的每个ACL规则的报文命中数量时，用于实现：确定每个ACL规则命中的数据报文对应的镜像报文的数量，在任一ACL规则命中数据报文时，生成并存储数据报文的镜像报文；将每个ACL规则命中的数据报文对应的镜像报文的数量确定为每个ACL规则的报文命中数量。
在一实施例中，处理器301在实现根据每个ACL规则的报文命中数量，确定失效的ACL规则时，用于实现：将报文命中数量为零所对应的ACL规则确定为失效的ACL规则。
需要说明的是，所属领域的技术人员可以清楚地了解到，为了描述的方便和简洁，上述描述的控制装置300的具体工作过程，可以参考前述ACL规则处理方法实施例中的对应过程，在此不再赘述。控制装置300可以应用于网络设备中。
本公开还提供一种存储介质，用于计算机可读存储，存储介质存储有一个或者多个程序，一个或者多个程序可被一个或者多个处理器执行，以实现如本公开说明书提供的任一项ACL规则处理方法。
其中，存储介质可以是前述实施例所述的网管设备的内部存储单元，例如网管设备的硬盘或内存。存储介质也可以是网管设备的外部存储设备，例如网管设备上配备的插接式硬盘，智能存储卡(Smart Media Card，SMC)，安全数字(Secure Digital，SD)卡，闪存卡(Flash Card)等。
本公开提供一种ACL规则处理方法、控制装置及存储介质，该ACL规则处理方法通过获取ACL规则的报文命中数量，这样能够基于ACL规则的报文命中数量，确定失效的ACL规则，从而可以删除失效的ACL规则或者输出用于提示用户删除失效的ACL规则的告警提示信息，能够准确地删除失效的ACL规则，极大地提高了ACL资源利用率。
本领域普通技术人员可以理解，上文中所公开方法中的全部或某些步骤、系统、装置中的功能模块/单元可以被实施为软件、固件、硬件及其适当的组合。在硬件实施例中，在以上描述中提及的功能模块/单元之间的划分不一定对应于物理组件的划分；例如，一个物理组件可以具有多个功能，或者一个功能或步骤可以由若干物理组件合作执行。某些物理组件或所有物理组件可以被实施为由处理器，如中央处理器、数字信号处理器或微处理器执行的软件，或者被实施为硬件，或者被实施为集成电路，如专用集成电路。这样的软件可以分布在计算机可读介质上，计算机可读介质可以包括计算机存储介质(或非暂时性介质)和通信介质(或暂时性介质)。如本领域普通技术人员公知的，术语计算机存储介质包括在用于存储信息(诸如计算机可读指令、数据结构、程序模块或其他数据)的任何方法或技术中实施的易失性和非易失性、可移除和不可移除介质。计算机存储介质包括但不限于RAM、ROM、EEPROM、闪存或其他存储器技术、CD-ROM、数字多功能盘(DVD)或其他光盘存储、磁盒、磁带、磁盘存储或其他磁存储装置、或者可以用于存储期望的信息并且可以被计算机访问的任何其他的介质。此外，本领域普通技术人员公知的是，通信介质通常包含计算机可读指令、数据结构、程序模块或者诸如载波或其他传输机制之类的调制数据信号中的其他数据，并且可包括任何信息递送介质。
应当理解，在本公开说明书和所附权利要求书中使用的术语“和/或”是指相关联列出的项中的一个或多个的任何组合以及所有可能组合，并且包括这些组合。需要说明的是，在本文中，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者系统不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者系统所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括该要素的过程、方法、物品或者系统中还存在另外的相同要素。
上述本公开序号仅仅为了描述，不代表实施例的优劣。以上，仅为本公开的具体实施例，但本公开的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本公开揭露的技术范围内，可轻易想到各种等效的修改或替换，这些修改或替换都应涵盖在本公开的保护范围之内。因此，本公开的保护范围应以权利要求的保护范围为准。

Claims (10)

  1. 一种ACL规则处理方法，包括：
    获取网络设备中的每个ACL规则的报文命中数量，所述报文命中数量为所述ACL规则在一个或多个预设时间周期内命中的数据报文的数量；
    根据每个所述ACL规则的所述报文命中数量，确定失效的ACL规则，并删除所述失效的ACL规则或者输出告警提示信息，所述告警提示信息用于提示用户删除失效的ACL规则。
  2. 根据权利要求1所述的ACL规则处理方法，其中，所述获取网络设备中的每个ACL规则的报文命中数量，包括：
    获取每个所述ACL规则各自匹配的计数器记录的报文命中数量，一个所述计数器对应一个或多个所述ACL规则。
  3. 根据权利要求2所述的ACL规则处理方法，其中，所述获取每个所述ACL规则各自匹配的计数器记录的报文命中数量之前，还包括：
    获取所述网络设备的计数器数量和所述网络设备中的ACL规则集合的ACL规则数量；
    在所述计数器数量大于或等于所述ACL规则数量时，给所述ACL规则集合中的每个ACL规则分配一个计数器；
    在所述计数器数量小于所述ACL规则数量时，给每个所述计数器分配多个ACL规则，直至所述ACL规则集合中的ACL规则被分配完。
  4. 根据权利要求3所述的ACL规则处理方法，其中，所述给每个所述计数器分配多个ACL规则，包括：
    将所述ACL规则集合中的ACL规则划分为多个ACL规则组，所述ACL规则组的数量小于或等于所述计数器数量；
    给每个所述ACL规则组分配一个所述计数器，所述ACL规则组包括多个ACL规则。
  5. 根据权利要求4所述的ACL规则处理方法，其中，所述将所述ACL规则集合中的ACL规则划分为多个ACL规则组，包括：
    获取所述ACL规则集合中的每个ACL规则的类型，并将所述类型相同的ACL规则划分为一个ACL规则组，得到多个ACL规则组；
    或者，确定所述ACL规则集合中的每个ACL规则内的IP地址，并将所述IP地址处于相同网段的ACL规则划分为一个ACL规则组，得到多个ACL规则组；
    或者，用所述ACL规则数量除以所述计数器数量，得到给每个所述计数器分配所述ACL规则的目标条数，并按照所述目标条数，将所述ACL规则集合中的ACL规则划分为多个ACL规则组。
  6. 根据权利要求3所述的ACL规则处理方法，其中，所述获取所述网络设备的计数器数量和所述网络设备中的ACL规则集合的ACL规则数量之后，还包括：
    在所述计数器数量小于所述ACL规则数量时，每次从所述ACL规则集合中选择与所述计数器数量匹配的多个ACL规则，并给选择的每个所述ACL规则分配一个所述计数器；
    在经过一个或多个所述预设时间周期后，将每个所述计数器记录的报文命中数量与每个所述计数器分配的ACL规则的规则编号进行关联存储；
    对每个所述计数器记录的报文命中数量进行清零，直至所述ACL规则集合中的每个ACL规则均被选择一次。
  7. 根据权利要求1-6中任一项所述的ACL规则处理方法，其中，所述获取网络设备中的每个ACL规则的报文命中数量，包括：
    确定每个所述ACL规则命中的数据报文对应的镜像报文的数量，在任一所述ACL规则命中数据报文时，生成并存储所述数据报文的镜像报文；
    将每个所述ACL规则命中的数据报文对应的镜像报文的数量确定为每个所述ACL规则的报文命中数量。
  8. 根据权利要求1-6中任一项所述的ACL规则处理方法，其中，所述根据每个所述ACL规则的所述报文命中数量，确定失效的ACL规则，包括：
    将所述报文命中数量为零所对应的所述ACL规则确定为失效的ACL规则。
  9. 一种控制装置，包括处理器、存储器、存储在所述存储器上并可被所述处理器执行的计算机程序以及用于实现所述处理器和所述存储器之间的连接通信的数据总线，其中所述计算机程序被所述处理器执行时，实现如权利要求1至8中任一项所述的ACL规则处理方法。
  10. 一种存储介质，用于计算机可读存储，所述存储介质存储有一个或者多个程序，所述一个或者多个程序可被一个或者多个处理器执行，以实现权利要求1至8中任一项所述的ACL规则处理的方法。
PCT/CN2023/080305 2022-06-29 2023-03-08 Acl规则处理方法、装置及存储介质 WO2024001282A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210753196.6A CN117353960A (zh) 2022-06-29 2022-06-29 Acl规则处理方法、装置及存储介质
CN202210753196.6 2022-06-29

Publications (1)

Publication Number Publication Date
WO2024001282A1 true WO2024001282A1 (zh) 2024-01-04

Family

ID=89367856

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/080305 WO2024001282A1 (zh) 2022-06-29 2023-03-08 Acl规则处理方法、装置及存储介质

Country Status (2)

Country Link
CN (1) CN117353960A (zh)
WO (1) WO2024001282A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101662425A (zh) * 2009-09-17 2010-03-03 中兴通讯股份有限公司 一种检测访问控制列表生效的方法和装置
CN106034054A (zh) * 2015-03-17 2016-10-19 阿里巴巴集团控股有限公司 冗余访问控制列表acl规则文件检测方法和装置
US20210336960A1 (en) * 2018-12-10 2021-10-28 Drivenets Ltd. A System and a Method for Monitoring Traffic Flows in a Communications Network
CN114422178A (zh) * 2021-12-10 2022-04-29 锐捷网络股份有限公司 一种基于访问控制列表的统计结果上报方法、设备及介质

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101662425A (zh) * 2009-09-17 2010-03-03 中兴通讯股份有限公司 一种检测访问控制列表生效的方法和装置
CN106034054A (zh) * 2015-03-17 2016-10-19 阿里巴巴集团控股有限公司 冗余访问控制列表acl规则文件检测方法和装置
US20210336960A1 (en) * 2018-12-10 2021-10-28 Drivenets Ltd. A System and a Method for Monitoring Traffic Flows in a Communications Network
CN114422178A (zh) * 2021-12-10 2022-04-29 锐捷网络股份有限公司 一种基于访问控制列表的统计结果上报方法、设备及介质

Also Published As

Publication number Publication date
CN117353960A (zh) 2024-01-05

Similar Documents

Publication Publication Date Title
US11956207B2 (en) Multi-tenant aware dynamic host configuration protocol (DHCP) mechanism for cloud networking
CN108632074B (zh) 一种业务配置文件下发方法和装置
US9253157B2 (en) Dynamically defining rules for network access
WO2018059222A1 (zh) 一种文件切片上传方法、装置及云存储系统
JP7026216B2 (ja) 仮想マシン管理
US10241681B2 (en) Management of physical extents for space efficient storage volumes
WO2021238248A1 (zh) 一种网络流量的分类处理方法、装置、设备及介质
US20170140315A1 (en) Managing incident tickets in a cloud managed service environment
CN109327557B (zh) 一种虚拟机ip地址的管理方法及装置
US10001926B2 (en) Management of extents for space efficient storage volumes by reusing previously allocated extents
US20160352821A1 (en) Method and system for allocating resources for virtual hosts
EP3958122A1 (en) Memory management method, apparatus, and system
CN111490890A (zh) 基于微服务架构的分级注册方法、装置、存储介质及设备
WO2024001282A1 (zh) Acl规则处理方法、装置及存储介质
CN114070755B (zh) 虚拟机网络流量确定方法、装置、电子设备和存储介质
US9563388B2 (en) Sharing a hosted device in a computer network
CN111522626A (zh) 一种虚拟机列表生成方法、装置及电子设备
US9660878B2 (en) Managing fabric priorities across heterogeneous server platforms
CN111221847B (zh) 监控数据存储方法、装置及计算机可读存储介质
US10057190B2 (en) Service access management
US20240236038A1 (en) Multi-tenant aware dynamic host configuration protocol (dhcp) mechanism for cloud networking
US11757830B2 (en) Method and apparatus for allocating CTDB-based virtual IP address, and distributed storage device
US20230195544A1 (en) Event log management
CN113905020A (zh) Ip地址动态切换方法、装置、主机及可读存储介质
CN113824605A (zh) 网络流采样方法、网络设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23829473

Country of ref document: EP

Kind code of ref document: A1