Re: [netmod] WG Last Call: draft-ietf-netmod-acl-model-15

[Kristian Larsson <[e-mail]>]

Mahesh,

I've reviewed this model, I think I largely caused the last couple of 
updates to it late last year. Overall I think it is a good model. 
Placement of feature-statements could be debated - no clear answers.
object groupings is something I would like to see in the model but it 
was always deferred.


On 2018-01-22 16:50, Kent Watsen wrote:
> Hi Mahesh,
> 
> Thanks, it doesn't get much more concrete then a pull request  ;)
> 
> Okay, so from a chair/shepherd perspective, can folks please consider 
> this update to -15 as the LC solution to removing the open issue Juergen 
> found in the draft?
> 
> As a contributor, I don't think the name of the groupings or their 
> description statements should allude to something that doesn't exist 
> yet.  Rather than e.g. "source-or-group", could it be instead something 
> like "source-type"?

+1

> Also, the update seems to be for both when 
> specifying networks as well as when specifying port-ranges, but the 
> original issue (see below) only mentioned addresses - is the 
> pull-request actually what's needed and the description of the issue in 
> Section 8 is incomplete?
> 
>      8.  Open Issues
> 
>         o  The current model does not support the concept of "containers"
> 
>              used to contain multiple addresses per rule entry.

Object groupings are useful whenever there are many of something. There 
are usually more address entries than ports, so perhaps more useful for 
addresses, but it can still be useful to say "NFS-PORTS" and mean all 
the ports that NFS use (god knows what they are).

Other have mentioned scale ACL and that it can be solved in other ways. 
To me, this sort of object-groupings is not about optimising things for 
the hardware but rather making it easy for me to write rules. I think it 
is paramount for security that ACLs can be easily read and understood. 
If we do not understand them, then we cannot say they are effective and 
secure. Object groupings greatly improves the readability of ACLs and 
thus makes it easier to write secure ACLs.

I understand the authors wishes to get the first version out the door 
but I can't help but wonder if it isn't just easier to add in object 
groupings now. It's not that damn complicated (they are just lists).
If not, I'm happy to work with them on the next version which could 
include object groupings.

As for the PR to add choices, there seems to be an extra container 
inserted. I also made a comment on GitHub.
At the very least, I think it would be best if this PR is fixed and 
merged before we proceed.

    kll