Re: [netmod] WG Last Call: draft-ietf-netmod-acl-model-15

[Eliot Lear <[e-mail]>]

Hi Kristian,


On 02.02.18 08:44, Kristian Larsson wrote:
> Mahesh,
>
> I've reviewed this model, I think I largely caused the last couple of
> updates to it late last year. Overall I think it is a good model.
> Placement of feature-statements could be debated - no clear answers.
> object groupings is something I would like to see in the model but it
> was always deferred.
>
>
> On 2018-01-22 16:50, Kent Watsen wrote:
>> Hi Mahesh,
>>
>> Thanks, it doesn't get much more concrete then a pull request  ;)
>>
>> Okay, so from a chair/shepherd perspective, can folks please consider
>> this update to -15 as the LC solution to removing the open issue
>> Juergen found in the draft?
>>
>> As a contributor, I don't think the name of the groupings or their
>> description statements should allude to something that doesn't exist
>> yet.  Rather than e.g. "source-or-group", could it be instead
>> something like "source-type"?
>
> +1
>
>> Also, the update seems to be for both when specifying networks as
>> well as when specifying port-ranges, but the original issue (see
>> below) only mentioned addresses - is the pull-request actually what's
>> needed and the description of the issue in Section 8 is incomplete?
>>
>>      8.  Open Issues
>>
>>         o  The current model does not support the concept of
>> "containers"
>>
>>              used to contain multiple addresses per rule entry.
>
> Object groupings are useful whenever there are many of something.
> There are usually more address entries than ports, so perhaps more
> useful for addresses, but it can still be useful to say "NFS-PORTS"
> and mean all the ports that NFS use (god knows what they are).
>
> Other have mentioned scale ACL and that it can be solved in other
> ways. To me, this sort of object-groupings is not about optimising
> things for the hardware but rather making it easy for me to write
> rules. I think it is paramount for security that ACLs can be easily
> read and understood. If we do not understand them, then we cannot say
> they are effective and secure. Object groupings greatly improves the
> readability of ACLs and thus makes it easier to write secure ACLs.
>
> I understand the authors wishes to get the first version out the door
> but I can't help but wonder if it isn't just easier to add in object
> groupings now. It's not that damn complicated (they are just lists).
> If not, I'm happy to work with them on the next version which could
> include object groupings.

Please let's aim for the next version.  This document just completed
what I think is its FIFTH last call, which to me is nothing short of insane.

Eliot

>
> As for the PR to add choices, there seems to be an extra container
> inserted. I also made a comment on GitHub.
> At the very least, I think it would be best if this PR is fixed and
> merged before we proceed.

>
>    kll
>
> _______________________________________________
> netmod mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/netmod