[Teas] issue on multiple match-criterion on the same time for a connectivity-group

["Sergio Belotti (Nokia)" <[e-mail]>]

Hello Pavan,Oscar, authors, WG,

I know draft-ietf-teas-ietf-network-slice-nbi-yang-14 has passed the WGLC but I've discovered a potential issue that heavily affects the model flexibility.

For my understanding of the model there is no possibility to have a combination of match criteria. For example: IF source-ip-address = 1.2.3.4 AND IF dscp = ef THEN map traffic onto target-connection-group X.
So we'd like to obtain that at the same connection-group X, it can be applied two matching criteria at the same time.

The model allows for the identification of multiple values (i.e. "value" is a leaf-list node). In principle, it is possible to identify an ip address and a dcsp value. The draft literally says "Provides a value for the Slice Service match criteria, e.g., IP prefix and VLAN ID". However, you can only specify one match-type.
The model permit to have  e.g. 2 match criteria   one with source IP address and another with DSCP values both pointing to same connection group or connectivity construct.
So basically taking an example from the draft you could have :

              "service-match-criteria": {
                "match-criterion": [
                  {
                    "index": 1,
                    "match-type": "ietf-nss:dscp",
                    "value": ["EF"],
                    "target-connection-group-id": "matrix6",
                    "target-connectivity-construct-id": "2"
                  },
                  {
                    "index": 2,
                                "match-type": "ietf-nss: source-ip-prefix",
                                "value": "1.2.3.4"
                    "target-connection-group-id": "matrix6",
                    "target-connectivity-construct-id": "2"
                  }

This type of encoding permits the OR of the matching criteria , I mean source-ip-address = 1.2.3.4 OR  dscp = ef., but how I can have the AND of the two ?

I know that for complex combination it is suggested to use the matching criteria type of ACL, defining a specific identity to be used as match-type


  identity acl {
    base service-match-type;
    description
      "Uses Access Control List (ACL) as match criteria
       for the Slice Service traffic.";
    reference
      "RFC 8519: YANG Data Model for Network Access Control
                 Lists (ACLs)";
  }

But there is no guideline on how to use it, and how to encode the "value" field, that is not present in ACL model.
ACL encodes a set of rules consisting of conditions and actions but there is no specific format that is able to capture a set of conditions .

What I would propose to solve the problem would be a list of pairs "match-type" and "value" , with match-type as key and value as another leaf. In this case for any "index" you could have multiple match-type and for the same "index" of match-criterion a combination of more than one match-type.

Something like:

"service-match-criteria": {
                "match-criterion": [
                  {
                    "index": 1,
                    "newlist" : [
                          {
                             "match-type": "ietf-nss:dscp",
                             "value": ["EF"]
                         },
                         {
                             "match-type": "ietf-nss: source-ip-prefix",
                              "value": "1.2.3.4"
                         }
                   ]
                   "target-connection-group-id": "matrix6",
                   "target-connectivity-construct-id": "2"
                 },

I think the modification is not complex and the model would be more flexible and "ready to be used" for match combinations instead to exploit another model like ACL.

Thanks
Sergio