Re: [netmod] I-D Action: draft-ietf-netmod-acl-model-17.txt

Kent Watsen <kwatsen@juniper.net> Wed, 14 March 2018 17:42 UTC

Return-Path: <kwatsen@juniper.net>
X-Original-To: netmod@ietfa.amsl.com
Delivered-To: netmod@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3756A124217 for <netmod@ietfa.amsl.com>; Wed, 14 Mar 2018 10:42:27 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.801
X-Spam-Level:
X-Spam-Status: No, score=-0.801 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=juniper.net
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id v7PzXTrZetCm for <netmod@ietfa.amsl.com>; Wed, 14 Mar 2018 10:42:22 -0700 (PDT)
Received: from mx0a-00273201.pphosted.com (mx0a-00273201.pphosted.com [208.84.65.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 72CC9120047 for <netmod@ietf.org>; Wed, 14 Mar 2018 10:42:22 -0700 (PDT)
Received: from pps.filterd (m0108158.ppops.net [127.0.0.1]) by mx0a-00273201.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w2EHduZt017016; Wed, 14 Mar 2018 10:42:20 -0700
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=PPS1017; bh=eTqw0K1pzOLj/scJPVG2XHuOPAfOcsvFaZmRvuy6y1o=; b=Rgi+ezbnJkZdoXKSNnqO/6DZPSJqCBBPbVbBqTSNE6JFCcr7TMlZVBI07A0E6fmuoNi8 OI2KviUz8MFtbAPGceJsPLgzu5/RM63s0MAQaLsXcG83Z7AuS9/76PVU7iyN2OKWGBg3 wQxWZcwflXnHzdYAZn+/HrhwVDEVoiTbi+WQaG8bifEbUYlwZh58c0BpnIZmidgxmftH pCRJpkyuy3JTT2GJDeoztrhB9st13MnJYaB39H56T8IttB6URUzxl5InoNqcM52FeBjB uNfwXu0RiEEvKjxCuGCiJwiCU6MqA1SZv7jtDaNrrtWCNorIRRbsMT+DMWIXmCUQMq7v Hg==
Received: from nam02-bl2-obe.outbound.protection.outlook.com (mail-bl2nam02lp0082.outbound.protection.outlook.com [207.46.163.82]) by mx0a-00273201.pphosted.com with ESMTP id 2gq78j85p1-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Wed, 14 Mar 2018 10:42:20 -0700
Received: from DM5PR05MB3484.namprd05.prod.outlook.com (10.174.240.147) by DM5PR05MB3659.namprd05.prod.outlook.com (10.174.190.156) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.588.7; Wed, 14 Mar 2018 17:42:16 +0000
Received: from DM5PR05MB3484.namprd05.prod.outlook.com ([fe80::d13e:bdcf:3798:c34f]) by DM5PR05MB3484.namprd05.prod.outlook.com ([fe80::d13e:bdcf:3798:c34f%2]) with mapi id 15.20.0609.006; Wed, 14 Mar 2018 17:42:16 +0000
From: Kent Watsen <kwatsen@juniper.net>
To: Mahesh Jethanandani <mjethanandani@gmail.com>
CC: NETMOD WG <netmod@ietf.org>
Thread-Topic: [netmod] I-D Action: draft-ietf-netmod-acl-model-17.txt
Thread-Index: AQHTszzPFGfywEAqkE2girWJpowDfKO/FKsAgAXu+ACAAhRzAIAHciwAgAB78oCAAMfYgA==
Date: Wed, 14 Mar 2018 17:42:16 +0000
Message-ID: <8509544F-40A6-4FF1-A8A5-354220C5EB2B@juniper.net>
References: <152011518004.12021.16209647205835091770@ietfa.amsl.com> <B961C87E-F925-4420-A23E-45BCB6AAA5AC@gmail.com> <18B0636C-36F2-4EF9-B518-04C29D2D3FDD@juniper.net> <40483B35-C929-4754-86F7-89D9FF38DE35@gmail.com> <789CD28A-F375-4392-9A09-5F1FAB135292@juniper.net> <70A81D2E-7038-4D06-B734-4675B30A1DF1@gmail.com>
In-Reply-To: <70A81D2E-7038-4D06-B734-4675B30A1DF1@gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
user-agent: Microsoft-MacOutlook/f.20.0.170309
x-originating-ip: [66.129.241.12]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1; DM5PR05MB3659; 7:ONdbcSn+f7p8lhvPUU0wda7BcM3zq6WRpQq6mf19PMUK9xGrFqfqAwTEoSSXMdizpPkvfQ7x6OQEzW4hby+64YcPYCiyYJt3fAaTlPkZa06Kt6CdIQDgN2gIhgh9fiIsa3rLpvcgRq00g7YSYNH3I+CoF3W1RdsT+nTBAClRq35+oNKA0neYFN7hCZo+wIw3FgswGkY5FyycfEBvyZYSF/dA5cf0Lhk2OmLWBCjFip9he/UiWswh+WmB0+qj+Lyi
x-ms-exchange-antispam-srfa-diagnostics: SSOS;
x-ms-office365-filtering-ht: Tenant
x-ms-office365-filtering-correlation-id: 421ae7f4-2f4f-43ed-8dba-08d589d2ed61
x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(48565401081)(5600026)(4604075)(3008032)(4534165)(4627221)(201703031133081)(201702281549075)(2017052603328)(7153060)(7193020); SRVR:DM5PR05MB3659;
x-ms-traffictypediagnostic: DM5PR05MB3659:
x-microsoft-antispam-prvs: <DM5PR05MB3659D9740F9E85F382ACB705A5D10@DM5PR05MB3659.namprd05.prod.outlook.com>
x-exchange-antispam-report-test: UriScan:(28532068793085)(10436049006162)(138986009662008)(85827821059158)(788757137089)(21748063052155);
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(5005006)(8121501046)(10201501046)(93006095)(93001095)(3002001)(3231221)(944501244)(52105095)(6055026)(6041310)(20161123558120)(20161123564045)(20161123560045)(20161123562045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(6072148)(201708071742011); SRVR:DM5PR05MB3659; BCL:0; PCL:0; RULEID:; SRVR:DM5PR05MB3659;
x-forefront-prvs: 0611A21987
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(396003)(366004)(39380400002)(346002)(39860400002)(376002)(51914003)(377424004)(57704003)(76104003)(51444003)(189003)(199004)(6486002)(59450400001)(6436002)(26005)(5250100002)(229853002)(6916009)(606006)(83716003)(53936002)(2950100002)(6246003)(14971765001)(97736004)(2900100001)(68736007)(3660700001)(186003)(4326008)(14454004)(316002)(39060400002)(25786009)(575784001)(86362001)(58126008)(93886005)(36756003)(5660300001)(478600001)(99286004)(3280700002)(105586002)(7736002)(76176011)(1411001)(2906002)(966005)(82746002)(8676002)(6506007)(6306002)(33656002)(236005)(102836004)(66066001)(81156014)(81166006)(106356001)(54896002)(6116002)(53546011)(53946003)(6512007)(16200700003)(8936002)(3846002)(579004)(569006); DIR:OUT; SFP:1102; SCL:1; SRVR:DM5PR05MB3659; H:DM5PR05MB3484.namprd05.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en;
received-spf: None (protection.outlook.com: juniper.net does not designate permitted sender hosts)
x-microsoft-antispam-message-info: 4RfsZr6LNx2PtqUb8bWwNJ8RJTj/nd6hKvOEYH3VmaEuxyFSGLjjy/zbkI2Fpmu/p3UJVrv5wIvGkV6l7O+bCm5wObraCeaCBOddP0MgQ1rJnXukwC2F77aYrhXpeqJ2L0+WUbmw3j79Gs633RdRlzMHRUEXBlrCYOEMr3qEGvHYVSA8e/fqxZjEuhZYZyn67qMIT+9EacDfXaUwzVTLAcHvGUzwp29B3ZDzZr919dsu+dUMbI2tJ3T7V8/WlvvCIPdm5gALpqnEl99vwHzTvno/0Kx0IIETqpS0RNWn6UXxjf9taTR55tYNeJxaUnxiOlaoA2IYXKwdQRg/64r4KA==
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: multipart/alternative; boundary="_000_8509544F40A64FF1A8A5354220C5EB2Bjunipernet_"
MIME-Version: 1.0
X-OriginatorOrg: juniper.net
X-MS-Exchange-CrossTenant-Network-Message-Id: 421ae7f4-2f4f-43ed-8dba-08d589d2ed61
X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Mar 2018 17:42:16.1174 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: bea78b3c-4cdb-4130-854a-1d193232e5f4
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR05MB3659
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2018-03-14_09:, , signatures=0
X-Proofpoint-Spam-Details: rule=outbound_spam_notspam policy=outbound_spam score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1711220000 definitions=main-1803140195
Archived-At: <https://mailarchive.ietf.org/arch/msg/netmod/7eKkbF2YoHfyQsfqkQWa4-FohlA>
Subject: Re: [netmod] I-D Action: draft-ietf-netmod-acl-model-17.txt
X-BeenThere: netmod@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: NETMOD WG list <netmod.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/netmod>, <mailto:netmod-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/netmod/>
List-Post: <mailto:netmod@ietf.org>
List-Help: <mailto:netmod-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/netmod>, <mailto:netmod-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 14 Mar 2018 17:42:27 -0000

Hi Mahesh,  please look for <<KENT>> below.

All, please take a look at the question around renaming the "access-lists" container.

Thanks,
Kent



On 3/13/18, 9:46 PM, "Mahesh Jethanandani" <mjethanandani@gmail.com<mailto:mjethanandani@gmail.com>> wrote:




On Mar 13, 2018, at 3:23 PM, Kent Watsen <kwatsen@juniper.net<mailto:kwatsen@juniper.net>> wrote:

Hi Mahesh,

Please look for <KENT> below.

Thanks,
Kent


On 3/8/18, 7:40 PM, "Mahesh Jethanandani" <mjethanandani@gmail.com<mailto:mjethanandani@gmail.com>> wrote:

Kent,



On Mar 7, 2018, at 1:55 PM, Kent Watsen <kwatsen@juniper.net<mailto:kwatsen@juniper.net>> wrote:

[To all those that said this draft was ready, really?]


Hi Mahesh,

Thanks for the update.  I found some more issues.  Some must be fixed,
others are nits, and might be caught by the RFC Editor.  But I think
that it's embarrassing to receive comments for such things from the
IESG, as is recently the case for the syslog draft, so please see
what you can do.

Thanks,
Kent


From Idnits:

 ** There are 6 instances of too long lines in the document, the longest one
    being 7 characters in excess of 72.

Hmm. The idnits at submission time did not complain. Will apply the new script that you provided to make sure I wrap them around.




 You wrote before that it was "Fixed", but it's still here?  Note: "**" is
 an error (idnits label)

 -- The document has examples using IPv4 documentation addresses according
    to RFC6890, but does not use any IPv6 documentation addresses.  Maybe
    there should be IPv6 examples, too?

 I don't feel strongly about this, but if it's easy enough to do...

In the Abstract:
 - I think the word "an" is missing (e.g., an ACL)

Added.




In the Introduction:
 - should "ordered-by-user" be "ordered-by user" to avoid confusion, or perhaps say it another way?

How about this in both the Abstract and the Introduction.

OLD:

ACL is a ordered-by-user set of rules

NEW:
An ACL is a set of rules, in an order set by the user

<KENT>or how about "An ACL is a user-ordered set of rules”?

Ok.





 - what does "a tuple of" mean?  Can this be restated?

How about this?

OLD:

The match criteria consist of a tuple of packet header match criteria and can have metadata match criteria as well.

NEW:

The match criteria consist of packet header matches, and or or metadata as described below:

<KENT>or how about "The match criteria can be a multiplicity of criteria, all of which must be true for the match to occur.   The match criteria may match against values in the packet header or against vendor-specific metadata about the packet."?   - or something in between?

Or simply as:

“The match criteria allows for definition of packet headers and metadata, all of which must be true for the match to occur."

<<KENT>> okay



 - s/In case vendor supports it/In case a vendor supports it/ ?

Ok.



 - "The list of X is endless depending on...".  Is "endless" the right word, perhaps restate?
OLD:

The list of potential actions is endless


NEW:

The list of potential actions is limitless

<KENT> or maybe "unbounded”?

Ok.




 - same sentence as above, should "networked devices" be "network" or "networking" devices?

Will change “networked devices” to “networking devices”.




In Section 3:
 - "A network system usually have a list of ACLs"  (s/system/systems/ or s/have/has/?)

s/have/has/.



 - "The match criteria consist of packet header matching" - is consist the right word?

How would you restate it? (After I have s/consist/consists/)

<KENT> see above (my comment before last, it is the same sentence, right?)

Once we agree on the above comment, I will replicate it.

<<KENT>> okay.



 - "It as also possible for ACE to match on metadata"  s/as/is/ and s/ACE/an ACE/

Ok



 - "When applied to interfaces of a networked device, the ACL is applied in a direction
    which indicates if it should be applied to packet entering (input) or leaving the
    device (output)."  - restate to talk about "ingress" and "egress”?

How about:

When applied to interfaces of a networked device, the ACL is applied in a direction which indicates if it should be applied to ingress interface (input) or egress interface (output).

<KENT>or maybe "When applied to interfaces of a networked device, distinct ACLs are defined for the ingress (input) and egress (output) directions.”

Ok.




 - "An example in the appendix shows how to express it in YANG model." - either this
   is not true, or the sentence should not be at the end of this paragraph

Removed.




In Section 3.1:
 - s/and must statements/and 'must' statements/

Done and s/if-feature/‘if-feature’/



 - s/define new "matches" choice/define a new "matches" choice/ ?

Done.




In Section 4.1:
 - "ietf-access-control-list" is the standard top level module for access lists
     - what does this mean?

OLD:
"ietf-access-control-list" is the standard top level module for access lists

NEW:
"ietf-access-control-list" is the top level module for access lists

<KENT> it's more than the word "standard".  Maybe something like this:  The "ietf-access-control-list"
module defines a container called "access-list"  - what do you think?

Ok.



<KENT>BTW, why is the container called "access-lists" and not e.g., "acls".  I thought that there was a node-naming idiom along the lines of "/widgets/widget" for when a list is a descendent of a container.

History. When we inherited the draft, it was named access-lists. I can change it to “acls”.

<<KENT>> I think it should be "acls", but I wouldn't want to make this change unilaterally.
Does anybody else have an issue with the container being called "access-lists" ?

 - The "access-lists" container stores a list of "acl". - s/stores/has or contains?/

s/stores/has/



 - "...that can be used to determine which rule was matched upon" - not sure if this
   part is needed, or maybe better restated ", which can later be used to determine…"?

Ok.



 - s/ability for ACL's to be/ability for ACLs to be/

Ok.




In Section 4.1 (in the YANG module):
 - A number of identities read "ACL that primarily matches...".  Is "primarily"
   an accurate word? - if so, then do we need to say anything about when it's
   not the case?

As one of the text says. It primarily matches IPv4, and does not match either ethernet or IPv6 headers. Such ACL types are different from the mixed ACL types that might match on a combination of ethernet and IPv4 headers etc.

<KENT>But my comment is more that "primarily" seems wishy-washy.  It seems like it doesn't *primarily* do something, it actually does it.   If there is a grey area, where it might match something else, if possible, maybe it would help to call that out?

Ok. Will drop the word “primarily”.





 Separately, s/ACL/an ACL/?

Ok.



 - A number of features read "Device can support..." - s/Device/The device/?

Ok.



 - "It can have one or more Access Control Lists" - lists should be singular.

Really? English grammar says that if a sentence has both a singular and a plural, the one nearest to the subject is the one you select.

<KENT>actually, I'm just going off the fact that the list node is call "acl", which is singular.  Perhaps even better would be to say:  It can contain one or more "acl" nodes - thoughts?

But even nodes is a plural. So what would be the difference between “acls” and “acl nodes”. I would rather have the RFC editor deal with this.

<<KENT>> My issue isn't so much the plurality, as it is matching what is in the YANG.   The node is called "acl", so then you want to say that there are multiple "acl" nodes (not "acls").  In fact, putting "acls" would be even more confusing is the "access-lists" container is renamed to "acls".


 - "An Access Control List(ACL)" - put a space before (ACL)

Ok.



 - " Indicates the primary intended" - here's that word "primary" again...
 - s/a list of access-list-entries(ACE)/ a list of access-list-entry nodes (ACE)/?

Ok.



 - s/List of access list entries(ACE)/List of access list entry nodes (ACE)/?
     - there is more than one instance of this in the model

Fixed.



 - "../../../../type" - still some long relative XPaths

Fixed.



 - " or referring to a group of source ports" - this isn't there yet.  I think you
   want to say something like "this is a choice so as to support future 'case'
   statements, such as one enabling a group of source ports to be referenced”

How about:

Choice of source port definition using range/operator or referring to a group of source ports, to be added as a future 'case' statement.

<KENT>I like my framing better because 1) it is less committal about the future and 2) it doesn't limit there to being just one 'case' statement that might be added in the future.

Ok.




 - ditto for "or referring to a group of destination ports."
 - ditto on both of the above for the "udp" container
 - is it possible for both "egress-interface" and "ingress-interface" leafs to
   be specified at the same time?  - if not, should there a 'must' statement to
   prevent that possibility? - or an explanation for what happens if it occurs?

Let me discuss this with my co-authors.

<KENT>any update on this?

Yes, it is possible for both the “egress-interface” and “ingress-interface” to be specified at the same time.

<<KENT>> okay, then maybe there can be an explanation of what happens when that occurs?


 - s/The ACL's applied/The ACLs applied/   (this happens more than once in model)

Fixed.


In Section 4.2:
 - references them by "uses" --> references them by 'uses' statements  ???

Ok.



 - not all your 'reference' statements have the title of the referenced document.

Fixed.



 - "then the datagram must be destroyed" - s/destroyed/dropped/?

Ok.



 - "or referring to a group of ..."  - same comments as for previous module
 - "ece" is missing a 'reference' statement?  -

Added.



 - "Indicates that the Urgent pointer field is significant" - urgent is
   capitalized, but there's no context as for why.  Perhaps missing a
   reference statement too?

Added a reference statement.



 - in "window-size" leaf description, remove parentheses

Ok.




In Section 4.3:
 - the text says that it drops traffic from X to Y, but the example seems to do
   the reverse.

Fixed.




In Section 4.4:
 - The "With the follow XML example:" <EXAMPLE> "This represents..." is
   difficult to read.  How about just having "The following XML example ...:”?

Fixed.


<KENT> BTW, I missed it before, but I think the 4.4 section title should be
plural: "Port Range Usage Examples”

The title now reads:

"Port Range Usage and Other Examples”. See below.

<<KENT>> works for me.



 - does the second example provide any value of the first? - seems the same to me…

Will change the example.

<KENT> was it changed per the next item below, or something else?

Changed the example to an ACE entry that drops all ping requests.

<<KENT>> okay.  But please tweak all your examples so that a '\' line-wrapping isn't
happening for a single charater.  e.g., remove one space from the indent or put the
xmlns on its own line.



 - seems like example 3 could also be expressed as "<lower-port>21</lower-port>",
   right?  - the text at the beginning of the section says this construct is
   possible, but there is no example for it.  Maybe this makes a better ex #2?

Have changed the language in the beginning of the section to say:

"When only a port is present, it represents a port, with the operator specifying the range."

That is because, it now a choice between specifying a range or specifying a single port with an operator.




In all your YANG modules:
 - replace "NETMOD (NETCONF Data Modeling Language)" with "NETMOD (Network
   Modeling) Working Group”

Ok.




In Section ??:
 In the examples, why did you add the "<?xml version="1.0" encoding="UTF-8"?>"
 line and the "config" element?  - the examples validate equally well when
 these are removed.

The examples can then be cut and pasted into any client such as ncclient which takes an entire <rpc>.




In Section 6:
 - s/three YANG module/three YANG modules/

Fixed.




In Section 6.1:
 - The first paragraph says "three URI", but it should be "three URIs”

Fixed.




In Section A.1:
 - "The following figure is the tree structure" - should say "tree diagram" and
   should reference the tree-diagrams draft, or else have a draft-wide "Tree
   Diagram Notation" section in the Introduction.

Added a section in the Introduction.



 - s/In other example/In another example/?
 - s/with new choice of actions/with a new choice of actions/?

Both fixed.




In Section A.3;
 - some 'reference' statements are missing titles

Added.



 - some 'description' statements might benefit from a 'reference’ statement

I have added references that I could find.



 - "The uint16 type placeholder type..." - is this a typo?

Dropped the second “type”.

Thanks.

<KENT>np



Kent // shepherd




===== original message ======

This version of the draft addresses comments raised during LC, shepherd review and other comments received during that period.



On Mar 3, 2018, at 2:13 PM, internet-drafts@ietf.org<mailto:internet-drafts@ietf.org> wrote:


A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Network Modeling WG of the IETF.

      Title           : Network Access Control List (ACL) YANG Data Model
      Authors         : Mahesh Jethanandani
                        Lisa Huang
                        Sonal Agarwal
                        Dana Blair
Filename        : draft-ietf-netmod-acl-model-17.txt
Pages           : 57
Date            : 2018-03-03

Abstract:
 This document defines a data model for Access Control List (ACL).
 ACL is a ordered-by-user set of rules, used to configure the
 forwarding behavior in device.  Each rule is used to find a match on
 a packet, and define actions that will be performed on the packet.


The IETF datatracker status page for this draft is:
https://urldefense.proofpoint.com/v2/url?u=https-3A__datatracker.ietf.org_doc_draft-2Dietf-2Dnetmod-2Dacl-2Dmodel_&d=DwICAg&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=9zkP0xnJUvZGJ9EPoOH7Yhqn2gsBYaGTvjISlaJdcZo&m=huBe-BRKk8B5XCRf7lG_gWUwZNr67SAA8GHfgYnyZoc&s=44GJlqxqB0YK5G9gb1TUzAobugMHxDWflaPCZ3IYpKA&e=

There are also htmlized versions available at:
https://urldefense.proofpoint.com/v2/url?u=https-3A__tools.ietf.org_html_draft-2Dietf-2Dnetmod-2Dacl-2Dmodel-2D17&d=DwICAg&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=9zkP0xnJUvZGJ9EPoOH7Yhqn2gsBYaGTvjISlaJdcZo&m=huBe-BRKk8B5XCRf7lG_gWUwZNr67SAA8GHfgYnyZoc&s=rbm91SSJ_0sxFxb692d0FH0G-dbBTAUCf2KRySyztJQ&e=
https://urldefense.proofpoint.com/v2/url?u=https-3A__datatracker.ietf.org_doc_html_draft-2Dietf-2Dnetmod-2Dacl-2Dmodel-2D17&d=DwICAg&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=9zkP0xnJUvZGJ9EPoOH7Yhqn2gsBYaGTvjISlaJdcZo&m=huBe-BRKk8B5XCRf7lG_gWUwZNr67SAA8GHfgYnyZoc&s=siypyBn3F8o6bsB3Z3E5qS0uaSq2EUGUPwirx_a_KDw&e=

A diff from the previous version is available at:
https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_rfcdiff-3Furl2-3Ddraft-2Dietf-2Dnetmod-2Dacl-2Dmodel-2D17&d=DwICAg&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=9zkP0xnJUvZGJ9EPoOH7Yhqn2gsBYaGTvjISlaJdcZo&m=huBe-BRKk8B5XCRf7lG_gWUwZNr67SAA8GHfgYnyZoc&s=t2lpzSSW72BvQK1VjPoxX0ADxhb9ZD0fp3fXqcd80g8&e=


Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org<https://urldefense.proofpoint.com/v2/url?u=http-3A__tools.ietf.org_&d=DwMFaQ&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=9zkP0xnJUvZGJ9EPoOH7Yhqn2gsBYaGTvjISlaJdcZo&m=BgyjnfSrZfswWrTMiW-PdKEJUEl3IXtwCSo1PQyVUaA&s=4FjGOld49GwI0moZ7h6ltluv0RXN1rPmGp0d-8mjDmA&e=>.

Internet-Drafts are also available by anonymous FTP at:
https://urldefense.proofpoint.com/v2/url?u=ftp-3A__ftp.ietf.org_internet-2Ddrafts_&d=DwICAg&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=9zkP0xnJUvZGJ9EPoOH7Yhqn2gsBYaGTvjISlaJdcZo&m=huBe-BRKk8B5XCRf7lG_gWUwZNr67SAA8GHfgYnyZoc&s=xP7z9VxUgtOtSVIgqPF5RKIqTOi6wj-HEXvZKBRTiUw&e=

_______________________________________________
netmod mailing list
netmod@ietf.org<mailto:netmod@ietf.org>
https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_netmod&d=DwICAg&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=9zkP0xnJUvZGJ9EPoOH7Yhqn2gsBYaGTvjISlaJdcZo&m=huBe-BRKk8B5XCRf7lG_gWUwZNr67SAA8GHfgYnyZoc&s=OKIVLXLo0Rsrf1DSoLWSyHj97DuE6vuaJ4Cqk_oi1HA&e=

Mahesh Jethanandani
mjethanandani@gmail.com<mailto:mjethanandani@gmail.com>

_______________________________________________
netmod mailing list
netmod@ietf.org<mailto:netmod@ietf.org>
https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_netmod&d=DwICAg&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=9zkP0xnJUvZGJ9EPoOH7Yhqn2gsBYaGTvjISlaJdcZo&m=huBe-BRKk8B5XCRf7lG_gWUwZNr67SAA8GHfgYnyZoc&s=OKIVLXLo0Rsrf1DSoLWSyHj97DuE6vuaJ4Cqk_oi1HA&e=

Mahesh Jethanandani
mjethanandani@gmail.com<mailto:mjethanandani@gmail.com>


Mahesh Jethanandani
mjethanandani@gmail.com<mailto:mjethanandani@gmail.com>