Subject: [netmod] Discussion on draft-huang-netmod-acl-03

From: YuekunLi <[email-masked]>
Date: Tue, 15 Apr 2014 09:39:16 -0700

Hi Lisa/Alex/Andy,

I went through 'draft-huang-netmod-acl-03' and had a few points that I would like to discuss with you guys.
 
1. I have some concern on the name of the feature we're modeling here.
   'Stateless Packet Filter' is accurate to describe this feature.
   However, none of the major vendors in the industry named their features as such.
   Aligning with some major vendors would be appropriate since we're setting a standard.
   From this perspective, I would suggest using 'Access Control List (ACL)'.
 
2. The latest revision of this doc briefly mentioned how a SPF (ACL) is applied to a target.
   I can see that section 3.3.4 covers the topic of attaching a SPF (ACL) to an interface.
   In this case, SPF (ACL) is used for traffic filtering.
   There are quite some scenarios, however, SPFs (ACLs) are deployed in other client applications such as QoS policy and routing protocols (e.g. BGP and OSPF).
   In most of these cases, SPF (ACL) is used for classification or filtering some routing information.
   Would you consider to initiate a new draft dedicated to topics of applying SPF (ACL) to each type of targets?
 
3. This document has had a detailed coverage on object-groups (both port object-groups and network object-groups).
   Could we consider to put object-groups in a separate module?
   The benefit of this practice is that it's easy for object-groups to be re-used by other modules besides SPF (ACL).
 
4. The packet-capture feature may not be appropriate in SPF (ACL) module.
   This feature actually introduces some new 'actions' to execute after we found a match between packet and SPE (ACE).
   These actions (forward and copy) are not purely filtering actions. 
   Therefore, they may not fit in the SPF (ACL) module very well.
 
5. In current SPF (ACL) module, each SPE (ACE) is assigned a string as its name.
   This may be too expensive in terms of memory consumption.
   Instead, a sequence number for each entry should be sufficient and easy to implement.
   Besides, sequence number does give uses the flexibilty to insert an entry to certain position of an existing SPF (ACL).
 
6. Is it better to have a higher level abstraction above SPF (ACL) module?
   By this, I mean creating a separate module that defines some common typedef/groupings.
   And not container in this module.
   Is this going to be an improvement for the modularity?

Please let me know if there is any confusion on above points.

Thanks
 
---------------
Yuekun Li