US 7,480,299 B2 · Rules engine for access control lists in network units

Abstract

A rules engine for the examination of selected fields in an addressed data packet has an access control list table of which the entries each define an access control list rule, an action and a chain identifier. The access control list rule may be a basic rule which refers to network addresses and transport layer port numbers. The rules engine also has an extension rule table of which the entries each define an extension rule, a respective action and a respective rule identifier. The extension rule may refer to a particular TCP flag. When a packet arrives, the engine searches both tables. This search is made independently of the ordinary network layer or link layer address lookup. If there is a match in both tables, and the chain identifier matches the extension rule identifier, the rules engine prescribes the action associated with the extension rule. If the chain identifier of a matched access control list rule does not match a rule identifier of a matched extension rule the rules engine prescribes the action associated with the basic rule. In the absence of a match with any access control list rule the action on a packet is based on the result from the ordinary address lookup.

Claims15

Dependent claims

A rules engine for the examination of selected fields in an addressed data packet, comprising:

an access control list table containing entries each defining an access control list rule, a respective first action and a chain identifier;
and
an extension rule table for entries each defining an extension rule, a respective second action and a respective rule identifier
wherein the rules engine is operative:
(a) to search said access control list table to ascertain a match between an access control list rule and said addressed data packet;
(b) to search said extension rule table to ascertain a match between an extension rule and said addressed data packet;
in the event of a matched access control list rule matched to said addressed data packet, to prescribe one of:
(ci) the respective second action associated with a matched extension rule in the event of correspondence between a chain identifier associated with the matched extension rule and a rule identifier identifying a match between that matched extension rule and said addressed data packet;
or
(cii) in the absence of said correspondence, the respective first action associated with said matched access control list rule.

7 more elements

A network unit comprising:

(1) a multiplicity of ports for receiving and forwarding addressed data packets;
(2) a lookup engine for producing forwarding data in response to address data in an addressed data packet;
(3) a post-processing engine for executing a forwarding action based on said forwarding data;
(4) a rules engine comprising:
(a) an access control list table containing entries each defining an access control list rule, a respective first action and a chain identifier;
and
(b) an extension rule table for entries each defining an extension rule, a respective second action and a respective rule identifier
wherein the rules engine is operative:
(i) to search said access control list table to ascertain a match between an access control list rule and said addressed data packet;
(ii) to search said extension rule table to ascertain a match between an extension rule and said addressed data packet;
and
in the event of a matched access control list rule matched to said addressed data packet, to prescribe one of:
(iiia) the respective second action associated with a matched extension rule in the event of correspondence between a chain identifier associated with the matched extension rule and a rule identifier identifying a match between that matched extension rule and said addressed data packet;
or
(iiib) in the absence of said correspondence, the respective first action associated with said matched access control list rule;
and
wherein said post-processing engine is operative to execute said respective first or second action as prescribed by said rules engine.

14 more elements

Dependencies are inferred from the claim text.

Rules engine for access control lists in network units

Life of this patent

Rules engine for access control lists in network units

Life of this patent

Abstract

Claims15