Re: [netmod] IETF ACL model

Mahesh Jethanandani <> Mon, 27 November 2017 17:47 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 0279F128D19 for <>; Mon, 27 Nov 2017 09:47:23 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id Ql4RJh0l8poe for <>; Mon, 27 Nov 2017 09:47:21 -0800 (PST)
Received: from ( [IPv6:2607:f8b0:400e:c00::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 88B2F126557 for <>; Mon, 27 Nov 2017 09:47:21 -0800 (PST)
Received: by with SMTP id r68so11532486pfe.10 for <>; Mon, 27 Nov 2017 09:47:21 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc:message-id:references :to; bh=T3F0a/MWxKTtm9vuKOp9x/vE2WkonRWs7M1hKqEKrD0=; b=Z/eygYnvnuaegTyrchJrZe5eoheGZjL+/zcQhXalG/cnQtZEM26KV5abE04SzGpxb7 GwJaAAHPOiBvtgcCRiH7PjssXvldXmya1TqqQmqMz4SSX1MMqv1vIEB5ZIqhC/Sh8yW5 bLgdkLftW117amOgQm2NHAEYqSgFOdod85M5zYnlkKsJ8HGzgbeUg145vk/YvLsyikmT 5H0DL475yLfQOIRAW9c1FRnv0QabBFghBTFOVOsMFgigKObO1VqbmCueLz9A1EG8WM4x qzrTVxTaUVKnEifXg7QBaPQmvlt64QKrzqz2VSjB4aftA+QP1C/nJESpqJfVYLOsHAE4 aGgw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=T3F0a/MWxKTtm9vuKOp9x/vE2WkonRWs7M1hKqEKrD0=; b=SDyXK01YkKHXdazEgMS5Ee4Zot8QpKHWWGyQ3ayOLBpcth2CRg49RkNuPojy4XKAJ9 RZFtbdA4JpeAqhuIufr/Lib7JFYfjqevqZ0n8UkI7l6OhaRT0/YUyvKB4pRxoMmHufu9 VnKgORTWjZuy5gVgFxkAL1VY23Dy662nOP+M1KK4Irq4nDE5yXtAdWgDNlEIH+j+jzEH w8B+0ElxqXP/CfI1E5SEasUKwNFwRuopgiPsPvCvHDayBW2gx8kH1iQu3si07cxZpUte FKS/x8yFVoLVoPV7Zo2rYaIiwE07U3usaLTt6fHuIAIAiTdtR+Avz7hKz1qCQ1Y6j2tv 2NKw==
X-Gm-Message-State: AJaThX5hCRoYv8/QB2SngEDiwGJD85rXsUsjk857NFJq+njM/dyJWFP3 Ej3R3v2PXSF4jKiPdT+hlO6xoRLs
X-Google-Smtp-Source: AGs4zMYN2/GqfDohuWpShoStBt9/LMRUiregyLbxG7GB0q6WquMbHeqxlFS6l/mCqSe4K+8SUlEreQ==
X-Received: by with SMTP id f6mr37321958pgt.89.1511804840523; Mon, 27 Nov 2017 09:47:20 -0800 (PST)
Received: from ([2600:1700:edb0:8fd0:c9c7:4c2b:674a:1f86]) by with ESMTPSA id u68sm49117388pfu.154.2017. (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 27 Nov 2017 09:47:19 -0800 (PST)
Content-Type: multipart/alternative; boundary="Apple-Mail=_C9822A9A-6C16-4BB1-A56A-BFCAF2D73760"
Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\))
From: Mahesh Jethanandani <>
In-Reply-To: <>
Date: Mon, 27 Nov 2017 09:47:16 -0800
Cc: Robert Wilton <>, Martin Bjorklund <>, Jeffrey Haas <>, "Sonal Agarwal (agarwaso)" <>, Kristian Larsson <>, Kristian Larsson <>
Message-Id: <>
References: <> <> <> <> <> <>
To: NetMod WG <>
X-Mailer: Apple Mail (2.3124)
Archived-At: <>
Subject: Re: [netmod] IETF ACL model
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: NETMOD WG list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 27 Nov 2017 17:47:23 -0000

An updated version of the model has been posted as part of the PR here <>.

The particular change removes any-acl from the model, expands on eth (to ethernet), removes acl- prefix for things like acl-type and acl-name. Please review.

> On Nov 27, 2017, at 5:17 AM, Kristian Larsson <> wrote:
> Robert Wilton <> writes:
>> Thinking about this some more. I'm not sure what it means for the "ACL 
>> Type" to be "any-acl". It seems that the "match any packet" should be a 
>> type of ACE, e.g. perhaps as the last entry of an ACL, rather than a 
>> type of ACL.
> Yes, I agree as so far that any-acl makes no sense as an acl-type. The
> way I understood acl-type, and the way that vendors have told me it will
> be used, is to say "this is an IPv4 ACL" and then on an attachment point
> you can specify that only ACLs of acl-type ipv4-acl can be attached to
> the interface. That makes perfect sense. I do not see how any-acl can
> map into this.
> I agree that any-acl is logically a type of ACE but we don't have an
> ace-type and the exact same information can IMHO already be conveyed
> WITHOUT the any-acl type and thus it has no reason to exist. Nor do we
> need a feature for it.
> From what I can tell the any-acl container in the ACE should be used to
> explicitly signify a match on "any". Think of IOS style ipv4 acl:
>  permit ip any any
> We have to provide a source and destination so this would be a rather
> explicit mapping of that. However, our structure in this YANG model is
> just completely different than an IOS command so I don't see why we
> should try and mimic IOS in the YANg model.
> Not specifying a destination IP address means we match on any
> destination IP address. The same is true for any other field we can
> match on. Not setting a match implies we don't try to match on that
> field, thus we allow "any" value. I think the logical continuation of
> this is that for an ACE with no matches defined at all, we match any
> packet. I think we can update the text to better explain this.
>> Otherwise if the ACL type is "any-acl" then this only allows two types 
>> of ACLs to be defined, neither of which seem to be particularly useful:
>> (1) An ACL that matches all traffic and permits it, i.e. the same as 
>> having no ACL at all.
>> (2) An ACL that matches all traffic and drops.
>> So I think perhaps the answer here is to define neither ACL type 
>> "any-acl" nor leaf "any". The presumption could be that any ACE that is 
>> configured to match no fields implicitly matches all packets (because 
>> all non specified fields are treated as wildcards), and then applies the 
>> permit/deny rule associated with the ACE. This logic can apply to all 
>> ACL types.
> Yes yes yes :)
>   Kristian.

Mahesh Jethanandani