IETF Logo Mail Archive

Re: [netmod] Mirja Kühlewind's Discuss on draft-ietf-netmod-acl-model-19: (with DISCUSS)

"Mirja Kuehlewind (IETF)" <ietf@kuehlewind.net> Tue, 25 September 2018 22:29 UTC

Return-Path: <ietf@kuehlewind.net>
X-Original-To: netmod@ietfa.amsl.com
Delivered-To: netmod@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 05C5B126DBF for <netmod@ietfa.amsl.com>; Tue, 25 Sep 2018 15:29:32 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); domainkeys=pass (1024-bit key) header.from=ietf@kuehlewind.net header.d=kuehlewind.net
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iXdvwGguzV0a for <netmod@ietfa.amsl.com>; Tue, 25 Sep 2018 15:29:31 -0700 (PDT)
Received: from kuehlewind.net (kuehlewind.net [83.169.45.111]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9C999130DD3 for <netmod@ietf.org>; Tue, 25 Sep 2018 15:29:30 -0700 (PDT)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=default; d=kuehlewind.net; b=IR4weruk7fkjKVGmZhQFVQSWT602vfoJqefNG8JGLTYqgg+m9edmZJlCFyjinTygiUnVieioSOg5GBrsiuBurHZR7P5ow/hI1KFAG233IAQvPCsBlINaQJGU7VMPA6Co6ZMJ9YUXTnCvHuGAL7RyMr8UrFUfaUJfSujdSp50wvY=; h=Received:Received:Content-Type:Mime-Version:Subject:From:In-Reply-To:Date:Cc:Content-Transfer-Encoding:Message-Id:References:To:X-Mailer:X-PPP-Message-ID:X-PPP-Vhost;
Received: (qmail 32708 invoked from network); 26 Sep 2018 00:22:47 +0200
Received: from mue-88-130-61-126.dsl.tropolys.de (HELO ?192.168.178.24?) (88.130.61.126) by kuehlewind.net with ESMTPSA (DHE-RSA-AES256-SHA encrypted, authenticated); 26 Sep 2018 00:22:47 +0200
Content-Type: text/plain; charset="utf-8"
Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\))
From: "Mirja Kuehlewind (IETF)" <ietf@kuehlewind.net>
In-Reply-To: <91758045-47c2-08f5-7cad-2f3ef333665c@cisco.com>
Date: Wed, 26 Sep 2018 00:22:46 +0200
Cc: NetMod WG Chairs <netmod-chairs@ietf.org>, The IESG <iesg@ietf.org>, NetMod WG <netmod@ietf.org>, draft-ietf-netmod-acl-model@ietf.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <FA97A783-F454-4A0C-BCDF-0413A7AA889E@kuehlewind.net>
References: <153753763758.7269.9597830616255329217.idtracker@ietfa.amsl.com> <E957D368-88BA-442F-AB7F-F8464847C719@gmail.com> <53A51142-7568-473D-B309-E3A86459B5F9@kuehlewind.net> <8C4D59E2-0C6D-4570-B8B0-D27D6C74CA2C@gmail.com> <91758045-47c2-08f5-7cad-2f3ef333665c@cisco.com>
To: Eliot Lear <lear@cisco.com>, Mahesh Jethanandani <mjethanandani@gmail.com>
X-Mailer: Apple Mail (2.3445.9.1)
X-PPP-Message-ID: <20180925222247.32699.85613@lvps83-169-45-111.dedicated.hosteurope.de>
X-PPP-Vhost: kuehlewind.net
Archived-At: <https://mailarchive.ietf.org/arch/msg/netmod/yQtVb1AyJJni-A9BaGY1w7hTKes>
Subject: Re: [netmod] Mirja Kühlewind's Discuss on draft-ietf-netmod-acl-model-19: (with DISCUSS)
X-BeenThere: netmod@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: NETMOD WG list <netmod.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/netmod>, <mailto:netmod-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/netmod/>
List-Post: <mailto:netmod@ietf.org>
List-Help: <mailto:netmod-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/netmod>, <mailto:netmod-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 25 Sep 2018 22:29:32 -0000

Hi Mahesh, hi Eliot,

please see below.

> Am 25.09.2018 um 22:25 schrieb Eliot Lear <lear@cisco.com>:
> 
> Just on this point:
> 
> On 25.09.18 20:35, Mahesh Jethanandani wrote:
>>> That’s do bad. However, the document must at least say that it’s scope is

(sorry for the type… I meant to say „too bad“.)

>>> restricted to TCP and UDP only and it would also be nice to reason why that restriction is and what would need to be done to extend it in future.
>> 
>> To the contrary. The model is not restricted to TCP and UDP. In Section 2, the document states that:
>> 
>>    ACL implementations in every device may vary greatly in terms of the
>>    filter constructs and actions that they support.  Therefore this
>>    draft proposes a model that can be augmented by standard extensions
>>    and vendor proprietary models.
>> 
>> 
Yes, ACL implementations differ, however, the protocol spec for SCTP and DCCP don’t have different implementation; their are mostly fixed. Unfortunately, firewalls often just block any other traffic than TCP and UDP, and restricting such a model only to those protocols will definitely not help the situation.

>> 
>> It is a different matter that it has chosen not to support SCTP and DCCP. That is because implementations today have not felt the market need to add support for those protocols. But that does not prevent anyone from adding support for them.

If your YANG model does not support long-existent and well-specified protocols, that doesn’t make it any easier to add support for these protocols to your firewall.

>> 
>> As far as an example for how the model can be extended in the future, see Appendix A - Extending ACL model examples.
> 
> It's important to not try to boil the ocean, and this model is already boiling a rather large river.  There's room for someone else to do more work.  I know I did ;-)

I would think that adding another well-specified protocols is actually only a limited effort. However, I don’t want to enforce a lot of additional work if people are not interested in that. What I still would like to see in the document is to make clear that these protocols have not just been not considered but some reasoning why only the currently supported protocols have been selected (in order to make the reader aware that this is not a full set).

Mirja


> 
> Eliot

v2.23.0 | Report a Bug | By Email