# US 9,882,766 B2 · System and method for access control list conversion > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,882,766 B2 - Document ID: US9882766B2 - Status: Granted - Kind: B2 - Application number: 13/852,863 - Filed: 2013-03-28 - Published: 2014-08-28 - Granted: 2018-01-30 - Earliest claimed: 2013-02-28 - Assignees: Arista Networks, Inc. - Applicants: Adam James Sweeney; Asang Kamalakar Dani - Inventors: Adam James Sweeney; Asang Kamalakar Dani - Web page: https://patentgrep.com/patent/US9882766B2 ## CPC - H04L 63/101: {Access control lists [ACL]} - H04L 45/745: Address table lookup; Address filtering - H04L 63/0263: {Rule management} - H04L 69/324: in the data link layer [OSI layer 2], e.g. HDLC - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method and apparatus of a device that converts an ordered ACL to an unordered ACL is described. In an exemplary embodiment, a network element receives an ordered access control list that includes a set of ordered rules, where each of the ordered rules includes an address range and an action. Furthermore, if two address ranges for two of the ordered rules overlap, a corresponding action of a preceding rule overrules a corresponding action of a subsequent rule for an overlapping range of addresses. The network element further converts the ordered access control list to an unordered access control list, where the unordered access control list includes a plurality of independent rules and each of the plurality of independent rules include a corresponding address range that is non-overlapping with other address ranges of the plurality of independent rules. In addition, the network element stores the unordered access control list, where the unordered access control list is used by the network element to make forwarding decisions for processing network data. ## Claims ### Claim 1 A non-transitory machine-readable medium having executable instructions to cause one or more processing units to convert an ordered access control list to an unordered access control list, the method comprising: receiving an ordered access control list of ordered rules, wherein each of the ordered rules includes an address range and an action, an address range includes a starting address and a range, and, if two address ranges in the ordered rules overlap, a corresponding action of a preceding rule of the ordered rules overrides a corresponding action of a subsequent rule of the ordered rules for an overlapping range of addresses; converting the ordered access control list to the unordered access control list, wherein the unordered access control lists includes a plurality of independent rules and each of the plurality of independent rules include a corresponding address range that is non-overlapping with other address ranges of the plurality of independent rules, wherein the converting includes, for each of the plurality of ordered rules in the ordered access control list, removing a deny address range of that deny rule from a set of potentially permitted addresses if the ordered rule is a deny rule, and adding an overlapping portion between a permit address range of that permit rule and a potentially permitted set of addresses to a set of actually permitted addresses, if that ordered rule is a permit rule, and generating the plurality of independent rules for the unordered access list from the set of actually permitted addresses; and storing the unordered access control list in the memory of the network element, wherein the unordered access control list is used by a network element to make forwarding decisions for processing network data and the ordered access control list of ordered rules and the unordered access control list achieve the same result for the network data. ### Claim 2 (depends on 1) The non-transitory machine-readable medium of claim 1, wherein the each of the plurality of independent rules is selected from the group consisting of a permit rule and a deny rule. ### Claim 3 (depends on 2) The non-transitory machine-readable medium of claim 2, wherein a permit rule includes a range of addresses that are allowed to be forwarded by a network element. ### Claim 4 (depends on 2) The non-transitory machine-readable medium of claim 2, wherein a deny rule includes a range of addresses that are dropped by a network element. ### Claim 5 (depends on 1) The non-transitory machine-readable medium of claim 1, wherein an address of an address range is selected from the group consisting of an Internet Protocol v4 address and an Internet Protocol v6 address. ### Claim 6 (depends on 1) The non-transitory machine-readable medium of claim 1, further comprising: returning the set of actually permitted addresses, wherein the set of actually permitted addresses includes the unordered access control list. ### Claim 7 (depends on 1) The machine-readable medium of claim 1, wherein the set of potentially permitted addresses initially includes the set of all possible addresses and the set of actually permitted initially is the empty set. ### Claim 8 A method to convert an ordered access control list to an unordered access control list, the method comprising: receiving an ordered access control list of ordered rules, wherein each of the ordered rules includes an address range and an action, an address range includes a starting address and a range, and, if two address ranges in the ordered rules overlap, a corresponding action of a preceding rule of the ordered rules overrides a corresponding action of a subsequent rule of the ordered rules for an overlapping range of addresses; converting, with a processor, the ordered access control list to the unordered access control list, wherein the unordered access control lists includes a plurality of independent rules and each of the plurality of independent rules include a corresponding address range that is non-overlapping with other address ranges of the plurality of independent rules, wherein the converting includes, for each of the plurality of ordered rules in the ordered access control list, removing a deny address range of that deny rule from a set of potentially permitted addresses if the ordered rule is a deny rule, and adding an overlapping portion between a permit address range of that permit rule and the potentially permitted set of addresses to a set of actually permitted addresses, if that ordered rule is a permit rule, and generating the plurality of independent rules for the unordered access list from the set of actually permitted addresses; and storing the unordered access control list in the memory of the network element, wherein the unordered access control list is used by a network element to make forwarding decisions for processing network data and the ordered access control list of ordered rules and the unordered access control list achieve the same result for the network data. ### Claim 9 (depends on 8) The method of claim 8, wherein the each of the plurality of independent rules is selected from the group consisting of a permit rule and a deny rule. ### Claim 10 (depends on 9) The method of claim 9, wherein a permit rule includes a range of addresses that are allowed to be forwarded by a network element. ### Claim 11 (depends on 9) The method of claim 9, wherein a deny rule includes a range of addresses that are dropped by a network element. ### Claim 12 (depends on 8) The method of claim 8, wherein an address of an address range is selected from the group consisting of an Internet Protocol v4 address and an Internet Protocol v6 address. ### Claim 13 (depends on 10) The method of claim 10, further comprising: returning the set of actually permitted addresses, wherein the set of actually permitted addresses includes the unordered access control list. ### Claim 14 A device to convert an ordered access control list to an unordered access control list, the apparatus comprising: a processor; a memory coupled to the processor though a bus; and a process executed from the memory by the processor to cause the processor to receive an ordered access control list of ordered rules, wherein each of the ordered rules includes an address range and an action and, if two address ranges in the ordered rules overlap, a corresponding action of a preceding rule of the ordered rules overrides a corresponding action of a subsequent rule of the ordered rules for an overlapping range of addresses, convert the ordered access control list to the unordered access control list, wherein the unordered access control lists includes a plurality of independent rules and each of the plurality of independent rules include a corresponding address range that is non-overlapping with other address ranges of the plurality of independent rules, and store the unordered access control list, wherein the unordered access control list is used by a network element to make forwarding decisions for processing network data, the process further causes the processor to convert the ordered access control list by, for each of the plurality of ordered rules in the ordered access control list, removing a deny address range of that deny rule from a set of potentially permitted addresses if the ordered rule is a deny rule, and adding an overlapping portion between a permit address range of that permit rule and the potentially permitted set of addresses to a set of actually permitted addresses, if that ordered rule is a permit rule, and generate the plurality of independent rules for the unordered access list from the set of actually permitted addresses, and the process further causes the processor to store the unordered access control list in the memory of the network element, wherein the unordered access control list is used by a network element to make forwarding decisions for processing network data and the ordered access control list of ordered rules and the unordered access control list achieve the same result for the network data. ### Claim 15 (depends on 14) The device of claim 14, wherein the each of the plurality of independent rules is selected from the group consisting of a permit rule and a deny rule.