Systems and methods of handling access control violations

Systems and methods of reporting access violations in a network device are disclosed. One such method comprises setting a forwarding index field in a specific entry of an access control list (ACL) to reference a specific forwarding table entry (FTE). The specific FTE is the only FTE associated with reporting access violations. The method further comprises setting a next destination field in the specific FTE to indicate a copy-to-processor behavior. The method further comprises setting the next destination field in the specific FTE to indicate a drop behavior. The setting of the next destination field is responsive to a timeout on a timer associated with reporting access violations.

BACKGROUND

Network devices which implement access control policies or criteria in order to filter out or drop packets can typically be configured to log or report violations of these policies. In order to report not only the violation itself but details about the packet which caused the violation, the packet is copied to the main processor, which consumes bus and/or processor bandwidth.

DETAILED DESCRIPTION

The inventive techniques disclosed herein allow efficient logging of access control violations by utilizing an access control list in conjunction with a forwarding table. By using one specific entry within the forwarding table in combination with an indirect forwarding index within the access control list, reporting of access violations to a host processor can be efficiently enabled or disabled by changing this single forwarding table entry. Disabling such reporting is sometimes desirable because providing packets to host processor consumes bus bandwidth, and without this technique, disabling involves updating multiple entries in access control list.

FIG. 1is a block diagram of a network including a network device which implements efficient logging of access control violations. A network device110receives packets from network nodes120through one or more ports130(also known as “network interfaces”). Using various policies and/or criteria, access control and reporting logic140(residing in network device110) decides whether the packets will be forwarded through device110, or will instead be dropped. For example, one policy might specify that all IP packets received from a specific subnet are permitted to transit, while another might specify that all Real-Time Transport (RTP) packets are to be dropped is notified when a received packet fails a policy/criteria, and may perform various logging and/or notification functions such as writing the violation to a file, displaying the violation on a screen, sending a Simple Network Management Protocol (SNMP) message that describes the violation to another device, etc.

Network device110is a general term intended to encompass any device which performs this access control function, which may include (but is not limited to) a firewall, a router, a switch, etc. In the example network ofFIG. 1, network device110is coupled to a local area network (LAN) segment through LAN link150, and to the Internet160through a wide area network (WAN) link170. Other types of links are also intended to be within the scope of this disclosure.

FIG. 2is a block diagram of selected components of network device110, in which functionality is divided between a packet processor210(implementing the data plane) and a host processor220(implementing the control plane). In particular, packet processor210implements access control logic230, which determines whether a packet is passed through or dropped. In some implementations, access control logic230corresponds to a packet classifier. Packet processor210also determines where the packet is forwarded in some implementations of network device110(e.g., routers).

Host processor220controls the behavior of packet processor210by configuring packet processor210in various ways, based on user input, and on information received in packets and passed from packet processor210to host processor220. Specifically, access control violation reporting logic240configures an access control list (access control list310inFIG. 3), by issuing a configuration command250. Packet processor210also notifies host processor220of errors or exceptions. In particular, packets which violate an access control rule are passed to access control violation reporting logic240through an access violation indication260.

FIG. 3is a diagram of various data structures used by access control logic230and access control violation reporting logic240. An access control list310includes one or more access control entries320, where each access control entry320includes a packet criteria330and a forwarding index340. A packet criteria330specifies (either explicitly or implicitly) particular fields of a packet, along with particular values. As each packet is received, access control logic230compares the data values in the specified fields of the packet to the values in a packet criteria330. Comparing packets with access control list310can be implemented in various ways, such as a software-based sequential search of a table stored in random access memory, a hardware-based simultaneous search of a content-addressable memory, a combination of the two, or any other implementation known to a person of ordinary skill in the art.

If a match of packet data with criteria330detected, packet processor210uses the forwarding index340for the matching packet criteria330to determine an action to be taken on the packet. The end result is either dropping the packet or passing the packet through. If the packet is dropped, this is considered an access violation and this may be reported to access control violation reporting logic240.

In existing systems, an access control entry (ACE) directly specifies one of the following actions to be taken by packet processor210: permit; drop and report the packet to host processor220; and drop without reporting the packet to host processor220. In contrast, access control list310as disclosed herein does not directly specify an action. Instead, the action is indirectly specified by forwarding index340, which is an index into a separate data structure, a forwarding table350. That is, forwarding index340refers to one of the forwarding table entries360in forwarding table350.

When a packet matches one of the packet criteria330in access control list310, packet processor210uses the corresponding forwarding index340to find a forwarding table entry360. Each forwarding table entry360includes a next destination370field, where the next destination corresponds to an internal destination within network device110, such as one of network interfaces130, or host processor220, or a null interface. Packet processor210then disposes of the packet according to next destination370. As a result, the packet may be: transferred to a network interface130, and thus be forwarded to another (remote) device; provided to host processor220, and specifically to access control violation reporting logic240; or provided to the null interface—which, by not forwarding to an actual interface, has the effect of dropping the packet.

In the implementation shown inFIG. 3, host processor220fills in and manages forwarding table350so that one entry is reserved for use by access control violation reporting logic240so that packets which violate particular ACEs are either provided to host processor220or dropped. Specifically, in this entry (represented inFIG. 3by “ACL_REPORT”) next destination370is toggled between a value representing host processor220(this value is referred to herein as “HOST”) and another value representing the null interface (referred to herein as “NULL”). For example, inFIG. 3, ACL entry320A and entry320B each have forwarding index340set to the same “ACL_REPORT” entry in forwarding table350. Thus, this “ACL_REPORT” entry determines the reporting behavior for entry320A and for entry320B: if a packet violates either of these two ACLs, the packet is provided to host processor220, or not, depending on the current value of the “ACL_REPORT” entry (“HOST” or “DROP”).

By using one specific entry within forwarding table350in combination with an indirect forwarding index within access control list310, access control violation reporting logic240can efficiently enable or disable reporting of access violations to host processor220by changing this single forwarding table entry. Disabling such reporting is sometimes desirable because providing packets to host processor220consumes bus bandwidth, and without this technique, disabling involves updating multiple entries in access control list310. In some implementations, reporting is initially enabled but is disabled by access control violation reporting logic240when the first access violation is reported. In some implementations, reporting is enabled again by logic240after a fixed period, such that violations are reported every N minutes (or seconds, hours, etc.)

Details of enabling and disabling access violation reporting for the implementation ofFIG. 3will now be discussed in connection withFIG. 4, which is a flowchart illustrating operation of access control violation reporting logic240(performed by host processor220). Logic240performs various functions related to reporting violations, each represented by an input arrow intoFIG. 4. These different paths may be invoked as a result of corresponding function calls, messages, events, or other mechanisms which should be familiar to a person of ordinary skill in the art.

Incoming path410represents the EnableGlobalReporting function, which controls how reporting for any access control violation is handled. In some implementations, this path is invoked during initialization of host processor220. When path410is invoked, block420sets the next destination field of the ACL_LOG entry in the forwarding table to the value “HOST”. Block430begins an iteration loop, covering all ACEs that have been configured to report violations (e.g., according to a configuration database or table). Within the loop, block440sets the forwarding index field for the current ACE to the value “ACL_LOG”, and the loop continues with the next iteration. When all ACEs have been handled, the loop has completed and block450starts an ACL reporting timer. (This timer block is optional, and may be user configurable.) As described earlier, a violation of one of those ACEs, packet processor210follows the forwarding index to the ACL_LOG entry. Since this entry indicates the next destination is host processor220, the packet which caused the violation is copied to host processor220.

This copy invokes incoming path460. When this path is invoked, block470reports the violation (e.g., writing to a file, sending an SNMP message, etc.). Block480sets the next destination field of the ACL_LOG entry in the forwarding table to the value “NULL”. As explained above, upon an access violation packet processor210follows the forwarding index to the ACL_LOG entry. Since this entry indicates the next destination is the null destination, the packet which caused the violation is discarded, which means host processor220is not notified and does not report the violation. Therefore, before the action in block480, access violations resulted in a copy of the packet to host processor220—but after this action, the packets are discarded instead of copied. Without such a change, host processor220is likely to be flooded with packets reporting access violations.

Path490is invoked upon expiration of the ACL reporting timer set by path410. When this path is invoked, block495sets the next destination field of the ACL_LOG entry in the forwarding table to the value “HOST”. As explained above, upon an access violation packet processor210follows the forwarding index to the ACL_LOG entry. Since this entry indicates the next destination is host processor220, the packet which caused the violation is once again copied to host processor220(and once again invoking path460).

The implementations described inFIGS. 3 and 4uses a single entry within forwarding table350to control reporting of access violations. Another implementation, described in connection withFIGS. 5 and 6, uses multiple entries within forwarding table350. The implementation ofFIG. 5is similar toFIG. 3except that ACEs for which reporting of violations is desired can be grouped, where each group corresponds to a different forwarding table entry. As shown inFIG. 5, ACE group510includes a single ACE, which points to FTE360A. ACE group520includes two ACEs, each of which point to FTE360B. Notably, these two FTEs have two different values such that, in the state shown inFIG. 5, packets violating the ACE in group510are provided to host processor220while packets violating the either of the ACEs in group520are dropped. Thus, this implementation provides more flexibility than the implementation ofFIGS. 3 and 4

Details of enabling and disabling access violation reporting for the implementation ofFIG. 5will now be discussed in connection with the flowchart ofFIG. 6. Incoming path610represents the EnableGrouplReporting function, which controls reporting of access control violations for a particular group (group N). When path610is invoked, block620sets the next destination field of the ACL_LOG entry in the forwarding table to the value “HOST”. Block630begins an iteration loop, covering all ACEs in group N (e.g., as specified in a configuration database or table). Within the loop, block640sets the forwarding index field for the current ACE to a value associated with the group (“ACL_LOG_N”), and the loop continues with the next iteration. When all ACEs in the group have been handled, the loop has completed and block650starts an ACL group reporting timer. (This timer block is optional, and may be user configurable.) As described earlier, a violation of one of those ACEs, packet processor210follows the forwarding index to the ACL_LOG_N entry (an entry specific to group N). Since this entry indicates the next destination is host processor220, the packet which caused the violation is copied to host processor220.

This copy invokes incoming path660. When this path is invoked, block670reports the violation for the ACE group (e.g., writing to a file, sending an SNMP message, etc.). Block680sets the next destination field of the ACL_LOG_N entry in the forwarding table to the value “NULL”. As explained above, upon an access violation packet processor210follows the forwarding index to the ACL_LOG_N entry. Since this entry indicates the next destination is the null destination, the packet which caused the violation is discarded, which means host processor220is not notified and does not report the violation. Therefore, before the action in block680, access violations resulted in a copy of the packet to host processor220—but after this action, the packets are discarded instead of copied. Without such a change, host processor220is likely to be flooded with packets reporting access violations.

Path690is invoked upon expiration of the ACL reporting timer set by path610. When this path is invoked, block695sets the next destination field of the ACL_LOG_N entry in the forwarding table to the value “HOST”. As explained above, upon an access violation packet processor210follows the forwarding index to the ACL_LOG_N entry. Since this entry indicates the next destination is host processor220, the packet which caused the violation is once again copied to host processor220(and once again invoking path660).

FIG. 7is a block diagram showing the operation and structure of packet processor210in more detail. In this example, packet processor210is illustrated as two separate components (access control logic230and forwarder750), but this division of functionality is only a logical convenience. Packet processor210receives packet710at ingress port130-I. Access control logic230uses one or more header fields (720) of the ingress packet as a key730to search access control list310. Access control logic230provides search result740to forwarder750as a forwarding index340into forwarding table350. Forwarder750obtains the corresponding next destination370from forwarding table350, then disposes of packet760by adding it to one of the packet queue770that is indicated by next destination370: one of the port-specific queues770-1. . . N; drop queue770-D; or host processor queue770-H.

FIG. 8is a block diagram of network device110, according to some implementations disclosed herein. Network device110includes packet processor210, host processor220memory810, a network interface820, a peripheral input output (I/O) interface830, and storage device840(e.g., non-volatile memory or a disk drive). These components are coupled via a bus850. Omitted fromFIG. 8are a number of components that are unnecessary to explain the operation of network device1100.

Access control logic230and access control violation reporting logic240can be implemented in hardware logic, software (i.e., instructions executing on a processor), or a combination thereof. Hardware embodiments includes (but are not limited to) a programmable logic device (PLD), programmable gate array (PGA), field programmable gate array (FPGA), an application-specific integrated circuit (ASIC), a system on chip (SoC), and a system in package (SiP).

When implemented as software, access control logic230and/or access control violation reporting logic240can be embodied in any computer-readable medium for use by or in connection with any processor which fetches and executes instructions. In the context of this disclosure, a “computer-readable medium” can be any means that can contain or store the program for use by, or in connection with, the processor. The computer readable medium can be based on electronic, magnetic, optical, electromagnetic, or semiconductor technology.

Specific examples of a computer-readable medium using electronic technology would include (but are not limited to) the following: an electrical connection (electronic) having one or more wires; a random access memory (RAM); a read-only memory (ROM); an erasable programmable read-only memory (EPROM or Flash memory). A specific example using magnetic technology includes (but is not limited to) a portable computer diskette. Specific examples using optical technology include (but are not limited to) an optical fiber and a portable compact disk read-only memory (CD-ROM).

The software components illustrated herein are abstractions chosen to illustrate how functionality is partitioned among components in some embodiments of various systems and methods of deferred error recovery disclosed herein. Other divisions of functionality are also possible, and these other possibilities are intended to be within the scope of this disclosure. Furthermore, to the extent that software components are described in terms of specific data structures (e.g., arrays, lists, flags, pointers, collections, etc.), other data structures providing similar functionality can be used instead.

Software components are described herein in terms of code and data, rather than with reference to a particular hardware device executing that code. Furthermore, to the extent that system and methods are described in object-oriented terms, there is no requirement that the systems and methods be implemented in an object-oriented language. Rather, the systems and methods can be implemented in any programming language, and executed on any hardware platform.

Software components referred to herein include executable code that is packaged, for example, as a standalone executable file, a library, a shared library, a loadable module, a driver, or an assembly, as well as interpreted code that is packaged, for example, as a class. In general, the components used by the systems and methods for handling access violations are described herein in terms of code and data, rather than with reference to a particular hardware device executing that code. Furthermore, the systems and methods can be implemented in any programming language, and executed on any hardware platform.

The flow charts herein provide examples of the operation of various software components, according to embodiments disclosed herein. Alternatively, these diagrams may be viewed as depicting actions of an example of a method implemented by such software components. Blocks in these diagrams represent procedures, functions, modules, or portions of code which include one or more executable instructions for implementing logical functions or steps in the process. Alternate embodiments are also included within the scope of the disclosure. In these alternate embodiments, functions may be executed out of order from that shown or discussed, including substantially concurrently or in reverse order, depending on the functionality involved. Not all steps are required in all embodiments.