Re: [netmod] WG Last Call: draft-ietf-netmod-acl-model-14

[Juergen Schoenwaelder <[e-mail]>]

On Thu, Nov 02, 2017 at 06:13:04AM +0630, Mahesh Jethanandani wrote:
> 
> Take the case where the desired selection is l2,-l3, ipv4 and ipv6. The current tree looks like this:
>

[...]
 
> whereas, if the design went with one match container with each group of leafs in their own container (to support the if-feature statement for that container), the tree would look like this:

[...]
 
> The difference though is small and comes down to a preference. Select one feature statement and get one container with everything in it, or define multiple feature statements and assemble together the pieces to define the ACE entry.

Well, you leave out all the duplication you have and you leave out
that the client needs to calculate where to configure an acl based on
the feature set of a server. Copying the acl from one system to
another requires to adjust containers for not good reason.

The number of feature combinations will grow soon out of control and
things get worse if vendors follow the direction and define vendor
specific feature combinations and associated containers.
 
> > BTW, how do I filter on TCP flags in combination with
> > a source IP address? There seem to be reasonable combinations of
> > features not even covered.
> 
> If the platform has declared support for feature that includes ipv4 (and/or ipv6) and tcp-acl, for a given ACE entry, it should be able to define a match filter that includes both the source IP address and the TCP flags. Do you see something that prevents it?

So if tcp-acl can be combined with other acls, why do I need in other
places of the data model combinations like l2-l3-ipv4-ipv6-acl? Why do
I not have tcp-acl, eth-acl, ipv4-acl, and ipv6-acl? (Note that l2-acl
is somewhat a misnomer - hence I used eth-acl instead.)

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: [phone]         Campus Ring 1 | 28759 Bremen | Germany
Fax:   [phone]         <http://www.jacobs-university.de/>