System and method for access control list conversion

A method to convert an ordered access control list to an unordered access control list, the method comprising:

• receiving an ordered access control list of ordered rules, wherein each of the ordered rules includes an address range and an action, an address range includes a starting address and a range, and, if two address ranges in the ordered rules overlap, a corresponding action of a preceding rule of the ordered rules overrides a corresponding action of a subsequent rule of the ordered rules for an overlapping range of addresses;
• converting, with a processor, the ordered access control list to the unordered access control list, wherein the unordered access control lists includes a plurality of independent rules and each of the plurality of independent rules include a corresponding address range that is non-overlapping with other address ranges of the plurality of independent rules, wherein the converting includes,
• for each of the plurality of ordered rules in the ordered access control list,
• removing a deny address range of that deny rule from a set of potentially permitted addresses if the ordered rule is a deny rule, and
• adding an overlapping portion between a permit address range of that permit rule and the potentially permitted set of addresses to a set of actually permitted addresses, if that ordered rule is a permit rule, and
• generating the plurality of independent rules for the unordered access list from the set of actually permitted addresses;
• and
• storing the unordered access control list in the memory of the network element, wherein the unordered access control list is used by a network element to make forwarding decisions for processing network data and the ordered access control list of ordered rules and the unordered access control list achieve the same result for the network data.

A device to convert an ordered access control list to an unordered access control list, the apparatus comprising:

• a processor;
• a memory coupled to the processor though a bus;
• and
• a process executed from the memory by the processor to cause the processor to receive an ordered access control list of ordered rules, wherein each of the ordered rules includes an address range and an action and, if two address ranges in the ordered rules overlap, a corresponding action of a preceding rule of the ordered rules overrides a corresponding action of a subsequent rule of the ordered rules for an overlapping range of addresses, convert the ordered access control list to the unordered access control list, wherein the unordered access control lists includes a plurality of independent rules and each of the plurality of independent rules include a corresponding address range that is non-overlapping with other address ranges of the plurality of independent rules, and store the unordered access control list, wherein the unordered access control list is used by a network element to make forwarding decisions for processing network data, the process further causes the processor to convert the ordered access control list by, for each of the plurality of ordered rules in the ordered access control list, removing a deny address range of that deny rule from a set of potentially permitted addresses if the ordered rule is a deny rule, and adding an overlapping portion between a permit address range of that permit rule and the potentially permitted set of addresses to a set of actually permitted addresses, if that ordered rule is a permit rule, and generate the plurality of independent rules for the unordered access list from the set of actually permitted addresses, and the process further causes the processor to store the unordered access control list in the memory of the network element, wherein the unordered access control list is used by a network element to make forwarding decisions for processing network data and the ordered access control list of ordered rules and the unordered access control list achieve the same result for the network data.