Re: [netmod] WG Last Call: draft-ietf-netmod-acl-model-14

Juergen Schoenwaelder <j.schoenwaelder@jacobs-university.de> Thu, 02 November 2017 08:21 UTC

Return-Path: <j.schoenwaelder@jacobs-university.de>
X-Original-To: netmod@ietfa.amsl.com
Delivered-To: netmod@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1FBD313FA6F for <netmod@ietfa.amsl.com>; Thu, 2 Nov 2017 01:21:22 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JOph4wV1W3SN for <netmod@ietfa.amsl.com>; Thu, 2 Nov 2017 01:21:19 -0700 (PDT)
Received: from atlas5.jacobs-university.de (atlas5.jacobs-university.de [212.201.44.20]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7557413F772 for <netmod@ietf.org>; Thu, 2 Nov 2017 01:21:19 -0700 (PDT)
Received: from localhost (demetrius5.irc-it.jacobs-university.de [10.70.0.222]) by atlas5.jacobs-university.de (Postfix) with ESMTP id 43A9569; Thu, 2 Nov 2017 09:21:18 +0100 (CET)
X-Virus-Scanned: amavisd-new at jacobs-university.de
Received: from atlas5.jacobs-university.de ([10.70.0.217]) by localhost (demetrius5.jacobs-university.de [10.70.0.222]) (amavisd-new, port 10032) with ESMTP id ZU8hMd9O4JvR; Thu, 2 Nov 2017 09:21:17 +0100 (CET)
Received: from hermes.jacobs-university.de (hermes.jacobs-university.de [212.201.44.23]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "hermes.jacobs-university.de", Issuer "Jacobs University CA - G01" (verified OK)) by atlas5.jacobs-university.de (Postfix) with ESMTPS; Thu, 2 Nov 2017 09:21:18 +0100 (CET)
Received: from localhost (demetrius3.jacobs-university.de [212.201.44.48]) by hermes.jacobs-university.de (Postfix) with ESMTP id 10E5620116; Thu, 2 Nov 2017 09:21:18 +0100 (CET)
X-Virus-Scanned: amavisd-new at jacobs-university.de
Received: from hermes.jacobs-university.de ([212.201.44.23]) by localhost (demetrius3.jacobs-university.de [212.201.44.32]) (amavisd-new, port 10024) with ESMTP id a109rRPjtaep; Thu, 2 Nov 2017 09:21:17 +0100 (CET)
Received: from elstar.local (elstar.jacobs.jacobs-university.de [10.50.231.133]) by hermes.jacobs-university.de (Postfix) with ESMTP id 99AC120114; Thu, 2 Nov 2017 09:21:17 +0100 (CET)
Received: by elstar.local (Postfix, from userid 501) id 8670E41481DC; Thu, 2 Nov 2017 09:19:50 +0100 (CET)
Date: Thu, 2 Nov 2017 09:19:50 +0100
From: Juergen Schoenwaelder <j.schoenwaelder@jacobs-university.de>
To: Mahesh Jethanandani <mjethanandani@gmail.com>
Cc: Kristian Larsson <kristian@spritelink.net>, "netmod@ietf.org" <netmod@ietf.org>
Message-ID: <20171102081950.osk2tqkfkertbg2b@elstar.local>
Reply-To: Juergen Schoenwaelder <j.schoenwaelder@jacobs-university.de>
Mail-Followup-To: Mahesh Jethanandani <mjethanandani@gmail.com>, Kristian Larsson <kristian@spritelink.net>, "netmod@ietf.org" <netmod@ietf.org>
References: <51DBEB86-2482-4D37-9F97-5EEE76B38285@juniper.net> <20171031102523.GB25608@spritelink.se> <CDEF081E-C5AA-459B-8DBB-770D5065FD26@gmail.com> <20171101112249.wmq4ggx2ixgn4kqo@elstar.local> <A55809F6-23FA-404D-BC0F-74AF11F508BF@gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <A55809F6-23FA-404D-BC0F-74AF11F508BF@gmail.com>
User-Agent: NeoMutt/20170714 (1.8.3)
Archived-At: <https://mailarchive.ietf.org/arch/msg/netmod/x_4xLVFR-E9rn5C9dt-V_u9YxDA>
Subject: Re: [netmod] WG Last Call: draft-ietf-netmod-acl-model-14
X-BeenThere: netmod@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: NETMOD WG list <netmod.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/netmod>, <mailto:netmod-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/netmod/>
List-Post: <mailto:netmod@ietf.org>
List-Help: <mailto:netmod-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/netmod>, <mailto:netmod-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 02 Nov 2017 08:21:22 -0000

On Thu, Nov 02, 2017 at 06:13:04AM +0630, Mahesh Jethanandani wrote:
> 
> Take the case where the desired selection is l2,-l3, ipv4 and ipv6. The current tree looks like this:
>

[...]
 
> whereas, if the design went with one match container with each group of leafs in their own container (to support the if-feature statement for that container), the tree would look like this:

[...]
 
> The difference though is small and comes down to a preference. Select one feature statement and get one container with everything in it, or define multiple feature statements and assemble together the pieces to define the ACE entry.

Well, you leave out all the duplication you have and you leave out
that the client needs to calculate where to configure an acl based on
the feature set of a server. Copying the acl from one system to
another requires to adjust containers for not good reason.

The number of feature combinations will grow soon out of control and
things get worse if vendors follow the direction and define vendor
specific feature combinations and associated containers.
 
> > BTW, how do I filter on TCP flags in combination with
> > a source IP address? There seem to be reasonable combinations of
> > features not even covered.
> 
> If the platform has declared support for feature that includes ipv4 (and/or ipv6) and tcp-acl, for a given ACE entry, it should be able to define a match filter that includes both the source IP address and the TCP flags. Do you see something that prevents it?

So if tcp-acl can be combined with other acls, why do I need in other
places of the data model combinations like l2-l3-ipv4-ipv6-acl? Why do
I not have tcp-acl, eth-acl, ipv4-acl, and ipv6-acl? (Note that l2-acl
is somewhat a misnomer - hence I used eth-acl instead.)

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1 | 28759 Bremen | Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>