Re: [I2nsf] Éric Vyncke's Discuss on draft-ietf-i2nsf-capability-data-model-12: (with DISCUSS and COMMENT)

Susan Hares <shares@ndzh.com> Mon, 21 September 2020 19:53 UTC

Return-Path: <shares@ndzh.com>
X-Original-To: i2nsf@ietfa.amsl.com
Delivered-To: i2nsf@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 99D3B3A0CD9; Mon, 21 Sep 2020 12:53:39 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0.948
X-Spam-Level:
X-Spam-Status: No, score=0.948 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DOS_OUTLOOK_TO_MX=2.845, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 06E0H5PfGGew; Mon, 21 Sep 2020 12:53:38 -0700 (PDT)
Received: from hickoryhill-consulting.com (50-245-122-97-static.hfc.comcastbusiness.net [50.245.122.97]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 711D93A0CD6; Mon, 21 Sep 2020 12:53:37 -0700 (PDT)
X-Default-Received-SPF: pass (skip=loggedin (res=PASS)) x-ip-name=174.25.170.45;
From: Susan Hares <shares@ndzh.com>
To: 'Éric Vyncke' <evyncke@cisco.com>, 'The IESG' <iesg@ietf.org>
Cc: draft-ietf-i2nsf-capability-data-model@ietf.org, i2nsf-chairs@ietf.org, i2nsf@ietf.org, 'Linda Dunbar' <dunbar.ll@gmail.com>
References: <160067995004.16306.16002090566817704506@ietfa.amsl.com>
In-Reply-To: <160067995004.16306.16002090566817704506@ietfa.amsl.com>
Date: Mon, 21 Sep 2020 15:53:19 -0400
Message-ID: <001301d69050$de74d370$9b5e7a50$@ndzh.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Mailer: Microsoft Outlook 14.0
Thread-Index: AQGzTKmS4z78KGhGfOZdCWk/xzu+E6m6B+xA
Content-Language: en-us
X-Antivirus: AVG (VPS 200921-14, 09/21/2020), Outbound message
X-Antivirus-Status: Not-Tested
X-Authenticated-User: skh@ndzh.com
Archived-At: <https://mailarchive.ietf.org/arch/msg/i2nsf/dS6NEapbp_wrGbn-Hj4sbiBIIv8>
Subject: Re: [I2nsf] Éric Vyncke's Discuss on draft-ietf-i2nsf-capability-data-model-12: (with DISCUSS and COMMENT)
X-BeenThere: i2nsf@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "*I2NSF: Interface to Network Security Functions mailing list*" <i2nsf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/i2nsf>, <mailto:i2nsf-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/i2nsf/>
List-Post: <mailto:i2nsf@ietf.org>
List-Help: <mailto:i2nsf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/i2nsf>, <mailto:i2nsf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 21 Sep 2020 19:53:40 -0000

Eric: 

Just a little bit of history - some of the past ADs suggested that informational models were optional.  Therefore, pushing forward with the information was difficult. 

In this case, the information model was helpful in distilling the key components for a capability model.  If you wish additional history, please let me know.  

Susan Hares 

-----Original Message-----
From: Éric Vyncke via Datatracker [mailto:noreply@ietf.org] 
Sent: Monday, September 21, 2020 5:19 AM
To: The IESG
Cc: draft-ietf-i2nsf-capability-data-model@ietf.org; i2nsf-chairs@ietf.org; i2nsf@ietf.org; Linda Dunbar; dunbar.ll@gmail.com
Subject: Éric Vyncke's Discuss on draft-ietf-i2nsf-capability-data-model-12: (with DISCUSS and COMMENT)

Éric Vyncke has entered the following ballot position for
draft-ietf-i2nsf-capability-data-model-12: Discuss

When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-i2nsf-capability-data-model/



----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

Thank you for the work put into this document.

While I do appreciate that a data model (this document) is derived from an information model, I am concerned that the information model is an expired draft whereas I would expect the information model being published first. Else, what is the use of the information model ? What was the WG reasoning behind 'putting the cart before the horses' ? My concern is that by publishing the YANG model, there is nearly no way to change the information model anymore.

Please find below a couple of non-blocking COMMENT points but also a couple of blocking DISCUSS points around IPv6. They should be easy to resolve. I would hate to have NSF having basic IPv6 capabilities that cannot be configured by using the YANG model of this document.

I hope that this helps to improve the document,

Regards,

-éric

== DISCUSS ==

-- Section 4.1 --

It is quite common to apply conditions based on the whole IPv6 extension header chain (i.e., presence of destination option header or wrong order of the extension headers). Why is there no such capabilities in this YANG module ? The only one is 'identity ipv6-next-header' that applies only to the first extension header.

What is the difference between 'identity ipv6-protocol' and 'identity ipv6-next-header' ? There is no 'protocol' field in the IPv6 header.

While fragmented IPv4 packets are part of the conditions ('identity ipv4-fragment-flags'), there is no equivalent in IPv6.


----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

-- Section 4.1 --
May be am I misreading the YANG tree, but, I see no 'sctp-capability' in the set of 'condition-capabilities' (even is SCTP is not heavily used).

Is there a real reason to have two related containers ?
generic-nsf-capabilities and advanced-nsf-capabilities. Why not a single one ?

Unsure what is meant by 'range' in 'identity range-ipv*-address'. Usually, addresses are filtered/matched by using a prefix length and not a range (that is difficult to implement in hardware).

Is there a reason why ICMP(v6) codes are not part of the conditions ?