ACLs (Access Control List) pamanetiweki madivayiri anogona kuitwa zvose mu hardware uye software, kana zvakawanda kazhinji kutaura, hardware uye software-based ACLs. Uye kana zvinhu zvose zvichifanira kujeka ne-software-based ACLs - iyi mitemo inochengetwa uye inoshandiswa mu RAM (kureva paDhipatimendi Rokudzora), nezvose zvinorambidzwa, ipapo tichanzwisisa kuti hardware-based ACLs inoshandiswa sei uye kushanda kwedu. article. Semuenzaniso, isu tichashandisa switch kubva kuExtremeSwitching series kubva kuExtreme Networks.
Sezvo isu tichifarira hardware-based ACLs, kushandiswa kwemukati kweData Plane, kana chipsets chaiyo (ASICs) inoshandiswa, inokosha zvikuru kwatiri. Yese Extreme Networks switch mitsara yakavakirwa paBroadcom ASICs, uye nekudaro ruzivo rwakawanda rwuri pazasi ruchavawo rwechokwadi kune mamwe ma switch pamusika anoitwa pane imwecheteyo ASICs.
Sezvinoonekwa kubva pamufananidzo uri pamusoro, iyo "ContentAware Engine" inobata zvakananga kushanda kweACLs mu chipset, zvakasiyana "ingress" uye "egress". Architecturally, iwo akafanana, chete "egress" haina scalable uye isingashande. Panyama, ese ari maviri "ContentAware Injini" ndeye TCAM ndangariro pamwe neinoperekedza pfungwa, uye yega yega mushandisi kana system ACL mutemo iri nyore-mask yakanyorwa kune iyi ndangariro. Ndokusaka chipset ichiita traffic packet nepaketi uye pasina kuderedzwa kwekuita.
Panyama, imwechete Ingress / Egress TCAM, zvakare, yakakamurwa zvine musoro muzvikamu zvakawanda (zvichienderana nehuwandu hwekuyeuka pachayo uye chikuva), iyo inonzi "ACL zvimedu". Semuenzaniso, chinhu chimwe chete chinoitika nemuviri yakafanana HDD palaptop yako paunogadzira akati wandei ane musoro madhiraivha pairi - C:>, D:>. Imwe neimwe ACL-slice, zvakare, ine ndangariro masero muchimiro che "tambo" apo "mitemo" (mitemo / bit masks) yakanyorwa.
Kupatsanurwa kweTCAM kuita ACL-zvidimbu zvine imwe pfungwa kumashure kwayo. Mune imwe neimwe yega ACL-zvidimbu, chete "mitemo" inowirirana nemumwe inogona kunyorwa. Kana imwe ye "mitemo" isingaenderani neyakapfuura, zvino ichanyorwa kune inotevera ACL-slice, zvisinei nekuti vangani vakasununguka mitsetse ye "mitemo" inosara mune yapfuura.
Saka kugarisana uku kana kusapindirana kwemitemo ye ACL kunobva kupi? Ichokwadi ndechokuti imwe TCAM "mutsara", apo "mitemo" yakanyorwa, ine urefu hwe232 bits uye yakakamurwa kuva minda yakawanda - Fixed, Field1, Field2, Field3. 232 bit kana 29 byte TCAM ndangariro inokwana kurekodha bit-mask yeiyo chaiyo MAC kana IP kero, asi zvishoma pane yakazara Ethernet packet musoro. Mune yega yega ACL-slice, iyo ASIC inoita yakazvimiririra yekutarisa zvinoenderana ne-bit-mask yakaiswa muF1-F3. Kazhinji, kutarisa uku kunogona kuitwa uchishandisa yekutanga 128 bytes yeEthernet musoro. Chaizvoizvo, chaizvo nekuti kutsvaga kunogona kuitwa pamusoro pe128 bytes, asi 29 byte chete inogona kunyorwa, kuti itarise chaiyo offset inofanira kusetwa inoenderana nekutanga kwepakiti. The offset imwe neimwe ACL-slice inoiswa apo mutemo wekutanga unonyorwa kwairi, uye kana, pakunyora mutemo unotevera, kudiwa kweimwe kubviswa kunowanikwa, ipapo mutemo wakadaro unoonekwa usingaenderani nekutanga uye unonyorwa kune inotevera ACL-chidimbu.
Tafura iri pazasi inoratidza kurongeka kwekuenderana kwemamiriro akatsanangurwa mu ACL. Imwe neimwe mutsara ine inogadzirwa bit-masks inoenderana neimwe uye isingaenderane nemimwe mitsara.
Pakiti yega yega yakagadziriswa neASIC inomhanyisa kutarisa kwakafanana mune yega ACL-slice. Cheki inoitwa kusvikira wokutanga machisi ari ACL-chidimbu, asi akawanda machisi vanobvumirwa kuti zvakafanana packet akasiyana ACL-zvidimbu. Mumwe nomumwe "mutemo" une chiito chinowirirana chinofanira kuitwa kana mamiriro (bit-mask) anoenderana. Kana machisi kuitika akati wandei ACL-zvidimbu kamwechete, ipapo mu "Action Conflict Resolution" bhuroka, kwakavakirwa pokutanga ACL-chidimbu, chisarudzo chinoitwa kuti chiito kuita. Kana ACL ine zvose "chiito" (mvumo/kuramba) uye "chiito-modifier" (kuverenga/QoS/log/...), zvino kana machisi akawanda chete yepamusoro-pokutanga "chiito" achaurayiwa, apo "chiito -modifier" zvese zvichapedzwa. Muenzaniso uri pazasi unoratidza kuti zvese zviverengero zvichawedzerwa uye iyo yepamusoro "kuramba" ichaitwa.
neruzivo rwakadzama nezvekushanda kwe ACL munzvimbo yeruzhinji pawebhusaiti . Chero mibvunzo inomuka kana yasara inogona kugara ichibvunzwa kuvashandi vedu vemuhofisi - .
Source: www.habr.com