Re: [netmod] IETF ACL model

[Mahesh Jethanandani <[e-mail]>]

This <https://github.com/netmod-wg/acl-model/pull/20> PR tries to address what are hopefully the last set of comments before we publish the draft for LC.

Unless I hear objections, I will roll in these changes by the end of the week (Dec. 15).

> On Nov 29, 2017, at 12:11 PM, Mahesh Jethanandani <[e-mail]> wrote:
> 
> The updated commit here <https://github.com/netmod-wg/acl-model/pull/19/commits/37e4c030180ae052a5fae26ca86813970fc6b4bf> takes care of restoring “type" to "acl-type", fixes some indentation issues, adds a choice for “l3" where either “ipv4" or “ipv6" can be selected, and a similar choice at “l4" that allows either “tcp", “udp" or “icmp" to be selected, and removes changes for “global" attachment point. Will add the last item as a separate commit.
> 
> Unless I hear objections, I will roll the pr/18 changes into the master branch in 48 hours.
> 
>> On Nov 28, 2017, at 2:17 AM, Martin Bjorklund <[e-mail] <mailto:[e-mail]>> wrote:
>> 
>> Mahesh Jethanandani <[e-mail] <mailto:[e-mail]>> wrote:
>>> An updated version of the model has been posted as part of the PR here
>>> <https://github.com/netmod-wg/acl-model/commit/2477cd400cce6d39933c908ad97da27ff759588b <https://github.com/netmod-wg/acl-model/commit/2477cd400cce6d39933c908ad97da27ff759588b>>.
>>> 
>>> The particular change removes any-acl from the model, expands on eth
>>> (to ethernet), removes acl- prefix for things like acl-type and
>>> acl-name. Please review.
>> 
>> I think 99% of the changes in this PR look good.  The one
>> exception is the typedef that used to be called "acl-type".  I think
>> it should still be called "acl-type".  "type" is too broad.  NOTE,
>> this is just the typedef; the leaf /access-lists/acl/type should keep
>> its name ("type").
>> 
>> 
>> /martin
>> 
>> 
>> 
>>> 
>>>> On Nov 27, 2017, at 5:17 AM, Kristian Larsson <[e-mail] <mailto:[e-mail]>>
>>>> wrote:
>>>> 
>>>> 
>>>> Robert Wilton <[e-mail] <mailto:[e-mail]>> writes:
>>>> 
>>>>> Thinking about this some more. I'm not sure what it means for the "ACL
>>>>> Type" to be "any-acl". It seems that the "match any packet" should be
>>>>> a
>>>>> type of ACE, e.g. perhaps as the last entry of an ACL, rather than a 
>>>>> type of ACL.
>>>> 
>>>> Yes, I agree as so far that any-acl makes no sense as an acl-type. The
>>>> way I understood acl-type, and the way that vendors have told me it
>>>> will
>>>> be used, is to say "this is an IPv4 ACL" and then on an attachment
>>>> point
>>>> you can specify that only ACLs of acl-type ipv4-acl can be attached to
>>>> the interface. That makes perfect sense. I do not see how any-acl can
>>>> map into this.
>>>> 
>>>> I agree that any-acl is logically a type of ACE but we don't have an
>>>> ace-type and the exact same information can IMHO already be conveyed
>>>> WITHOUT the any-acl type and thus it has no reason to exist. Nor do we
>>>> need a feature for it.
>>>> 
>>>> From what I can tell the any-acl container in the ACE should be used
>>>> to
>>>> explicitly signify a match on "any". Think of IOS style ipv4 acl:
>>>> permit ip any any
>>>> 
>>>> We have to provide a source and destination so this would be a rather
>>>> explicit mapping of that. However, our structure in this YANG model is
>>>> just completely different than an IOS command so I don't see why we
>>>> should try and mimic IOS in the YANg model.
>>>> 
>>>> Not specifying a destination IP address means we match on any
>>>> destination IP address. The same is true for any other field we can
>>>> match on. Not setting a match implies we don't try to match on that
>>>> field, thus we allow "any" value. I think the logical continuation of
>>>> this is that for an ACE with no matches defined at all, we match any
>>>> packet. I think we can update the text to better explain this.
>>>> 
>>>> 
>>>> 
>>>>> Otherwise if the ACL type is "any-acl" then this only allows two types
>>>>> of ACLs to be defined, neither of which seem to be particularly
>>>>> useful:
>>>>> (1) An ACL that matches all traffic and permits it, i.e. the same as 
>>>>> having no ACL at all.
>>>>> (2) An ACL that matches all traffic and drops.
>>>>> 
>>>>> So I think perhaps the answer here is to define neither ACL type 
>>>>> "any-acl" nor leaf "any". The presumption could be that any ACE that
>>>>> is
>>>>> configured to match no fields implicitly matches all packets (because 
>>>>> all non specified fields are treated as wildcards), and then applies
>>>>> the
>>>>> permit/deny rule associated with the ACE. This logic can apply to all 
>>>>> ACL types.
>>>> 
>>>> Yes yes yes :)
>>>> 
>>>>  Kristian.
>>> 
>>> Mahesh Jethanandani
>>> [e-mail] <mailto:[e-mail]>
>>> 
> 
> Mahesh Jethanandani
> [e-mail] <mailto:[e-mail]>

Mahesh Jethanandani
[e-mail]