Re: [netmod] I-D Action: draft-ietf-netmod-acl-model-17.txt

Kent Watsen <> Tue, 13 March 2018 22:23 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 44585127023 for <>; Tue, 13 Mar 2018 15:23:36 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.699
X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id YwpCFJ66w4t4 for <>; Tue, 13 Mar 2018 15:23:31 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id AE43F12DA48 for <>; Tue, 13 Mar 2018 15:23:29 -0700 (PDT)
Received: from pps.filterd ( []) by ( with SMTP id w2DMDw1O028847; Tue, 13 Mar 2018 15:23:26 -0700
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=PPS1017; bh=Qo6vI/WTdKxqT66k5EvB1HU9lnQ9xQ1wM9ItEbs/ySo=; b=BfLLoGHfV46l5CrWZh2JeFCNZcDTUfxXErcR+kYgbxWSDzaZP2ce7mYwZDjEdEVGl2WX OM0m5gK8vsYDuJpPW1EDggT81ogFrczwPgwWmARczoFmqB29PKXIc3sQy+Bcx+ZPryja 80EuP6VgGQvn01dJ0S1walQYCC6IeLnyHzjQ2kyzXGrLRxXde33B/ecngGgjq/gSE3DQ Ej9HYbPoVUGE4Zkpclp4XtDvg/KYQznmIJExlaFE4w/okfYUjq8v5t/S5x7QYGRGLzui sDiQ/hSdcScJ/ZW43/JU5q0sxTstCFuzOVGajtbhHzA9lsFVOw6YWB0nJV2V2uUPCVcm zg==
Received: from ( []) by with ESMTP id 2gpmjug9ct-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Tue, 13 Mar 2018 15:23:25 -0700
Received: from ( by ( with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.588.7; Tue, 13 Mar 2018 22:23:23 +0000
Received: from ([fe80::d13e:bdcf:3798:c34f]) by ([fe80::d13e:bdcf:3798:c34f%2]) with mapi id 15.20.0588.013; Tue, 13 Mar 2018 22:23:23 +0000
From: Kent Watsen <>
To: Mahesh Jethanandani <>
Thread-Topic: [netmod] I-D Action: draft-ietf-netmod-acl-model-17.txt
Thread-Index: AQHTszzPFGfywEAqkE2girWJpowDfKO/FKsAgAXu+ACAAhRzAIAHciwA
Date: Tue, 13 Mar 2018 22:23:22 +0000
Message-ID: <>
References: <> <> <> <>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: en-US
user-agent: Microsoft-MacOutlook/f.20.0.170309
x-originating-ip: []
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1; DM5PR05MB3244; 7:TRW+Q9OGfcP+vA4xRcGRCjs+c8f+Pv5pQNnbmdjEX55RExkvdL1h+vHjZiiQOEhHch6e5scDIoE48W9HwDojFkYnKgXKY/0mCtGIdTgB2/oBqh7lRNqqMbtMmPc1rs1rRDF1DgAmyrg0L3Z6cFGqSi5uVECoFF/1EXMVMMdA8cRstyOk68L7iSb7h19MKvfxVZSnp7IpZ4GFFF3Q1fsthf+hWnWCCmL+LPPoxvMkLhRdbwHJAGD4lARVs7n2QEiH
x-ms-exchange-antispam-srfa-diagnostics: SSOS;
x-ms-office365-filtering-ht: Tenant
x-ms-office365-filtering-correlation-id: 55f3358d-1ed7-48dd-b67c-08d58931086d
x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(48565401081)(5600026)(4604075)(3008032)(4534165)(4627221)(201703031133081)(201702281549075)(2017052603328)(7153060)(7193020); SRVR:DM5PR05MB3244;
x-ms-traffictypediagnostic: DM5PR05MB3244:
x-microsoft-antispam-prvs: <>
x-exchange-antispam-report-test: UriScan:(28532068793085)(10436049006162)(138986009662008)(85827821059158)(788757137089)(21748063052155);
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(5005006)(8121501046)(3002001)(10201501046)(3231221)(944501244)(52105095)(93006095)(93001095)(6055026)(6041310)(20161123558120)(20161123564045)(20161123560045)(20161123562045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(6072148)(201708071742011); SRVR:DM5PR05MB3244; BCL:0; PCL:0; RULEID:; SRVR:DM5PR05MB3244;
x-forefront-prvs: 0610D16BBE
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(396003)(346002)(376002)(39860400002)(366004)(39380400002)(189003)(51444003)(377424004)(51914003)(199004)(57704003)(76104003)(966005)(575784001)(14454004)(478600001)(106356001)(606006)(86362001)(5250100002)(8936002)(81156014)(8676002)(3660700001)(68736007)(9326002)(33656002)(36756003)(81166006)(229853002)(6916009)(105586002)(66066001)(2950100002)(236005)(76176011)(3280700002)(93886005)(14971765001)(97736004)(39060400002)(99286004)(53946003)(6306002)(5660300001)(2900100001)(25786009)(2906002)(6512007)(4326008)(54896002)(7736002)(316002)(6246003)(53936002)(83716003)(82746002)(102836004)(58126008)(6506007)(1411001)(6486002)(6116002)(3846002)(186003)(26005)(6436002)(53546011)(59450400001)(579004); DIR:OUT; SFP:1102; SCL:1; SRVR:DM5PR05MB3244;; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en;
received-spf: None ( does not designate permitted sender hosts)
x-microsoft-antispam-message-info: kHh9DM/iLGcwKCVIvihUqD5M+f/ouGmOlDAi2mdXXjvR82VH4ALeRzO3aMhqGSa/kC9r/Rxfv9RFG7bZCMGzSprMTtyVCNipuiCaSZaszl7NPWE1wQhGVDjmJ5Hyx51pxEGN+y9xIyrItczKfT9EZpg2jkl5Nwntl9c3qkQj1gW6YM24W6Fou79ePUjRqFIrceN3pJLM69rVnSUeqhcF0dLcAfxuvTd69eyOyrg4sRd37GHGVa0GHqyh43qnZCt9ycGfxr3qZfj3uIoWTvOPXb6IW6dACjlmtuHkw1Db9IvWoUNvxZkg62tQpECNZt/j64l74FzOOcvqX8ISS/TT2Q==
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: multipart/alternative; boundary="_000_789CD28AF37543929A095F1FAB135292junipernet_"
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 55f3358d-1ed7-48dd-b67c-08d58931086d
X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Mar 2018 22:23:22.9978 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: bea78b3c-4cdb-4130-854a-1d193232e5f4
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR05MB3244
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2018-03-13_09:, , signatures=0
X-Proofpoint-Spam-Details: rule=outbound_spam_notspam policy=outbound_spam score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1711220000 definitions=main-1803130247
Archived-At: <>
Subject: Re: [netmod] I-D Action: draft-ietf-netmod-acl-model-17.txt
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: NETMOD WG list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 13 Mar 2018 22:23:36 -0000

Hi Mahesh,

Please look for <KENT> below.


On 3/8/18, 7:40 PM, "Mahesh Jethanandani" <<>> wrote:


On Mar 7, 2018, at 1:55 PM, Kent Watsen <<>> wrote:

[To all those that said this draft was ready, really?]

Hi Mahesh,

Thanks for the update.  I found some more issues.  Some must be fixed,
others are nits, and might be caught by the RFC Editor.  But I think
that it's embarrassing to receive comments for such things from the
IESG, as is recently the case for the syslog draft, so please see
what you can do.


From Idnits:

 ** There are 6 instances of too long lines in the document, the longest one
    being 7 characters in excess of 72.

Hmm. The idnits at submission time did not complain. Will apply the new script that you provided to make sure I wrap them around.

 You wrote before that it was "Fixed", but it's still here?  Note: "**" is
 an error (idnits label)

 -- The document has examples using IPv4 documentation addresses according
    to RFC6890, but does not use any IPv6 documentation addresses.  Maybe
    there should be IPv6 examples, too?

 I don't feel strongly about this, but if it's easy enough to do...

In the Abstract:
 - I think the word "an" is missing (e.g., an ACL)


In the Introduction:
 - should "ordered-by-user" be "ordered-by user" to avoid confusion, or perhaps say it another way?

How about this in both the Abstract and the Introduction.


ACL is a ordered-by-user set of rules

An ACL is a set of rules, in an order set by the user

<KENT>or how about "An ACL is a user-ordered set of rules"?

 - what does "a tuple of" mean?  Can this be restated?

How about this?


The match criteria consist of a tuple of packet header match criteria and can have metadata match criteria as well.


The match criteria consist of packet header matches, and or or metadata as described below:

<KENT>or how about "The match criteria can be a multiplicity of criteria, all of which must be true for the match to occur.   The match criteria may match against values in the packet header or against vendor-specific metadata about the packet."?   - or something in between?

 - s/In case vendor supports it/In case a vendor supports it/ ?


 - "The list of X is endless depending on...".  Is "endless" the right word, perhaps restate?

The list of potential actions is endless


The list of potential actions is limitless

<KENT> or maybe "unbounded"?

 - same sentence as above, should "networked devices" be "network" or "networking" devices?

Will change “networked devices” to “networking devices”.

In Section 3:
 - "A network system usually have a list of ACLs"  (s/system/systems/ or s/have/has/?)


 - "The match criteria consist of packet header matching" - is consist the right word?

How would you restate it? (After I have s/consist/consists/)

<KENT> see above (my comment before last, it is the same sentence, right?)

 - "It as also possible for ACE to match on metadata"  s/as/is/ and s/ACE/an ACE/


 - "When applied to interfaces of a networked device, the ACL is applied in a direction
    which indicates if it should be applied to packet entering (input) or leaving the
    device (output)."  - restate to talk about "ingress" and "egress”?

How about:

When applied to interfaces of a networked device, the ACL is applied in a direction which indicates if it should be applied to ingress interface (input) or egress interface (output).

<KENT>or maybe "When applied to interfaces of a networked device, distinct ACLs are defined for the ingress (input) and egress (output) directions."

 - "An example in the appendix shows how to express it in YANG model." - either this
   is not true, or the sentence should not be at the end of this paragraph


In Section 3.1:
 - s/and must statements/and 'must' statements/

Done and s/if-feature/‘if-feature’/

 - s/define new "matches" choice/define a new "matches" choice/ ?


In Section 4.1:
 - "ietf-access-control-list" is the standard top level module for access lists
     - what does this mean?

"ietf-access-control-list" is the standard top level module for access lists

"ietf-access-control-list" is the top level module for access lists

<KENT> it's more than the word "standard".  Maybe something like this:  The "ietf-access-control-list"
module defines a container called "access-list"  - what do you think?

<KENT>BTW, why is the container called "access-lists" and not e.g., "acls".  I thought that there was a node-naming idiom along the lines of "/widgets/widget" for when a list is a descendent of a container.

 - The "access-lists" container stores a list of "acl". - s/stores/has or contains?/


 - "...that can be used to determine which rule was matched upon" - not sure if this
   part is needed, or maybe better restated ", which can later be used to determine…"?


 - s/ability for ACL's to be/ability for ACLs to be/


In Section 4.1 (in the YANG module):
 - A number of identities read "ACL that primarily matches...".  Is "primarily"
   an accurate word? - if so, then do we need to say anything about when it's
   not the case?

As one of the text says. It primarily matches IPv4, and does not match either ethernet or IPv6 headers. Such ACL types are different from the mixed ACL types that might match on a combination of ethernet and IPv4 headers etc.

<KENT>But my comment is more that "primarily" seems wishy-washy.  It seems like it doesn't *primarily* do something, it actually does it.   If there is a grey area, where it might match something else, if possible, maybe it would help to call that out?

 Separately, s/ACL/an ACL/?


 - A number of features read "Device can support..." - s/Device/The device/?


 - "It can have one or more Access Control Lists" - lists should be singular.

Really? English grammar says that if a sentence has both a singular and a plural, the one nearest to the subject is the one you select.

<KENT>actually, I'm just going off the fact that the list node is call "acl", which is singular.  Perhaps even better would be to say:  It can contain one or more "acl" nodes - thoughts?

 - "An Access Control List(ACL)" - put a space before (ACL)


 - " Indicates the primary intended" - here's that word "primary" again...
 - s/a list of access-list-entries(ACE)/ a list of access-list-entry nodes (ACE)/?


 - s/List of access list entries(ACE)/List of access list entry nodes (ACE)/?
     - there is more than one instance of this in the model


 - "../../../../type" - still some long relative XPaths


 - " or referring to a group of source ports" - this isn't there yet.  I think you
   want to say something like "this is a choice so as to support future 'case'
   statements, such as one enabling a group of source ports to be referenced”

How about:

Choice of source port definition using range/operator or referring to a group of source ports, to be added as a future 'case' statement.

<KENT>I like my framing better because 1) it is less committal about the future and 2) it doesn't limit there to being just one 'case' statement that might be added in the future.

 - ditto for "or referring to a group of destination ports."
 - ditto on both of the above for the "udp" container
 - is it possible for both "egress-interface" and "ingress-interface" leafs to
   be specified at the same time?  - if not, should there a 'must' statement to
   prevent that possibility? - or an explanation for what happens if it occurs?

Let me discuss this with my co-authors.

<KENT>any update on this?

 - s/The ACL's applied/The ACLs applied/   (this happens more than once in model)


In Section 4.2:
 - references them by "uses" --> references them by 'uses' statements  ???


 - not all your 'reference' statements have the title of the referenced document.


 - "then the datagram must be destroyed" - s/destroyed/dropped/?


 - "or referring to a group of ..."  - same comments as for previous module
 - "ece" is missing a 'reference' statement?  -


 - "Indicates that the Urgent pointer field is significant" - urgent is
   capitalized, but there's no context as for why.  Perhaps missing a
   reference statement too?

Added a reference statement.

 - in "window-size" leaf description, remove parentheses


In Section 4.3:
 - the text says that it drops traffic from X to Y, but the example seems to do
   the reverse.


In Section 4.4:
 - The "With the follow XML example:" <EXAMPLE> "This represents..." is
   difficult to read.  How about just having "The following XML example ...:”?


<KENT> BTW, I missed it before, but I think the 4.4 section title should be
plural: "Port Range Usage Examples"

 - does the second example provide any value of the first? - seems the same to me…

Will change the example.

<KENT> was it changed per the next item below, or something else?

 - seems like example 3 could also be expressed as "<lower-port>21</lower-port>",
   right?  - the text at the beginning of the section says this construct is
   possible, but there is no example for it.  Maybe this makes a better ex #2?

Have changed the language in the beginning of the section to say:

"When only a port is present, it represents a port, with the operator specifying the range."

That is because, it now a choice between specifying a range or specifying a single port with an operator.

In all your YANG modules:
 - replace "NETMOD (NETCONF Data Modeling Language)" with "NETMOD (Network
   Modeling) Working Group”


In Section ??:
 In the examples, why did you add the "<?xml version="1.0" encoding="UTF-8"?>"
 line and the "config" element?  - the examples validate equally well when
 these are removed.

The examples can then be cut and pasted into any client such as ncclient which takes an entire <rpc>.

In Section 6:
 - s/three YANG module/three YANG modules/


In Section 6.1:
 - The first paragraph says "three URI", but it should be "three URIs”


In Section A.1:
 - "The following figure is the tree structure" - should say "tree diagram" and
   should reference the tree-diagrams draft, or else have a draft-wide "Tree
   Diagram Notation" section in the Introduction.

Added a section in the Introduction.

 - s/In other example/In another example/?
 - s/with new choice of actions/with a new choice of actions/?

Both fixed.

In Section A.3;
 - some 'reference' statements are missing titles


 - some 'description' statements might benefit from a 'reference’ statement

I have added references that I could find.

 - "The uint16 type placeholder type..." - is this a typo?

Dropped the second “type”.



Kent // shepherd

===== original message ======

This version of the draft addresses comments raised during LC, shepherd review and other comments received during that period.

On Mar 3, 2018, at 2:13 PM,<> wrote:

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Network Modeling WG of the IETF.

      Title           : Network Access Control List (ACL) YANG Data Model
      Authors         : Mahesh Jethanandani
                        Lisa Huang
                        Sonal Agarwal
                        Dana Blair
Filename        : draft-ietf-netmod-acl-model-17.txt
Pages           : 57
Date            : 2018-03-03

 This document defines a data model for Access Control List (ACL).
 ACL is a ordered-by-user set of rules, used to configure the
 forwarding behavior in device.  Each rule is used to find a match on
 a packet, and define actions that will be performed on the packet.

The IETF datatracker status page for this draft is:

There are also htmlized versions available at:

A diff from the previous version is available at:

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at<>0RXN1rPmGp0d-8mjDmA&e=>.

Internet-Drafts are also available by anonymous FTP at:

netmod mailing list<>

Mahesh Jethanandani<>

netmod mailing list<>

Mahesh Jethanandani<>