Subject: [netmod] Working group Last Call: draft-ietf-netmod-acl-model-06

From: Qin Wu <[email-masked]>
Date: Thu, 21 Jan 2016 07:45:28 +0000

Hi, all:
Sorry for late response to this call.
I have taken some time today to re-read the latest version of draft-ietf-netmod-acl-model-06 and have two comments:
1. This draft defines two module, one is IETF-PACKET-FIELDS, the other is ietf-access-control-list module,
I am wondering whether ietf-packet-fields module can be defined in more generic way that can be applied to other modules defined somewhere else?
e.g., in ietf-packet-fields module, acl-ip-header-fields grouping is defined, I am wondering whether prefix "acl-" can be removed to make it more generic?

2. This draft briefly discuss Linux nftables which is interesting, I am wondering how this nftable is different from rib discussed in I2RS, is there any dependency
between model proposed in this draft and the model proposed in I2RS? If this has been discussed already, please ignore this comment.

Besides these two comments, I think this draft is good enough to move forward. Thanks!

-Qin
> On 12/9/15 5:27 PM, Nadeau Thomas wrote:
>> 	This email initiates a NETMOD WG Last call for draft-ietf-netmod-acl-model-06. 
>> Please review the draft and make any comments to the list by 
>> Wednesday, 16 December, 2015 by 8AM EST.
>> 
>> 	Tom and Kent (as NETMOD Co-chairs)
>> 
>> 
>> _______________________________________________
>> netmod mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/netmod

---

From: Ebben Aries <[email-masked]>
Date: Thu, 21 Jan 2016 22:56:16 -0700

> e.g., in ietf-packet-fields module, acl-ip-header-fields grouping is defined, I am wondering whether prefix "acl-" can be removed to make it more generic?

What you'll likely run into here is that the header fields defined in
acl-*-header-fields are more or less the lowest common denominators for
the application of "acl" - Not all header fields are defined here.

I suppose an approach could be to define generic groupings of all header
fields and create per application groupings, referencing what is
supported with appropriate constraints, etc...  Not sure what that buys
here since you're likely to have overlap but not complete parity between
the different consumers of these packet fields.

/ebben

---

From: Dean Bogdanovic <[email-masked]>
Date: Thu, 21 Jan 2016 22:16:00 -0800

> On Jan 21, 2016, at 9:56 PM, Ebben Aries <[email-masked]> wrote:
> 
> 

Correct, it was lowest common denominator.
> supported with appropriate constraints, etc…
>  Not sure what that buys

The ietf-packet-fields could be reused in QoS for matching and in some vendors case, they are using access list for matching. So it is consistent naming for match conditions. The QoS design team mapped out there own match conditions.

---

From: "Acee Lindem (acee)" <[email-masked]>
Date: Fri, 22 Jan 2016 12:40:45 +0000

On 1/22/16, 12:56 AM, "netmod on behalf of Ebben Aries"
<[email-masked] on behalf of [email-masked]> wrote:

>> I am wondering whether ietf-packet-fields module can be defined in more
>>generic way that can be applied to other modules defined somewhere else?
>> e.g., in ietf-packet-fields module, acl-ip-header-fields grouping is
>>defined, I am wondering whether prefix "acl-" can be removed to make it
>>more generic?
>

Furthermore, this is not a generic IP packet fields YANG module. It is a
module for matching IP packet fields using traditional ACL semantics.
Hence, changing the container name won’t change the content or semantics.
If anything, the module name should be changed to include “acl-“ and not
imply that it is generic.

Thanks,
Acee

---

From: "Lisa (Yi) Huang" <[email-masked]>
Date: Fri, 22 Jan 2016 20:46:23 +0000

On 1/22/16, 4:40 AM, "netmod on behalf of Acee Lindem (acee)"
<[email-masked] on behalf of [email-masked]> wrote:

>Hence, changing the container name won¹t change the content or semantics.
>If anything, the module name should be changed to include ³acl-³ and not

There is no intention to include all packet fields in this module but QoS
could reuse this module.

Thanks,
Lisa

---

From: Mahesh Jethanandani <[email-masked]>
Date: Fri, 22 Jan 2016 13:04:56 -0800

> On Jan 22, 2016, at 12:46 PM, Lisa (Yi) Huang <[email-masked]> wrote:
> 
> 
> 
> <[email-masked] <mailto:[email-masked]> on behalf of [email-masked] <mailto:[email-masked]>> wrote:
> 
>> 
>> 
>> Hence, changing the container name wonąt change the content or semantics.
>> If anything, the module name should be changed to include łacl-ł and not

The QoS module has defined its own set of fields that packets could get classified on, and has no plans to use the ACL packet field definitions.

>>> [email-masked] <mailto:[email-masked]>
>>> https://www.ietf.org/mailman/listinfo/netmod <https://www.ietf.org/mailman/listinfo/netmod>
>> 
>> [email-masked] <mailto:[email-masked]>
>> https://www.ietf.org/mailman/listinfo/netmod <https://www.ietf.org/mailman/listinfo/netmod>
> 
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/netmod <https://www.ietf.org/mailman/listinfo/netmod>
Mahesh Jethanandani
[email-masked]