Subject: Re: [netmod] Discussion on draft-huang-netmod-acl-03

From: Juergen Schoenwaelder <[email-masked]>
Date: Wed, 21 May 2014 08:51:23 +0200

Hi,

is it correct that I did not see any answer to this message?

/js

On Tue, Apr 15, 2014 at 09:39:16AM -0700, YuekunLi wrote:
>  
> Hi Lisa/Alex/Andy,
> 
> I went through 'draft-huang-netmod-acl-03' and had a few points that I would like to discuss with you guys.
>  
> 1. I have some concern on the name of the feature we're modeling here.
>    'Stateless Packet Filter' is accurate to describe this feature.
>    However, none of the major vendors in the industry named their features as such.
>    Aligning with some major vendors would be appropriate since we're setting a standard.
>    From this perspective, I would suggest using 'Access Control List (ACL)'.
>  
> 2. The latest revision of this doc briefly mentioned how a SPF (ACL) is applied to a target.
>    I can see that section 3.3.4 covers the topic of attaching a SPF (ACL) to an interface.
>    In this case, SPF (ACL) is used for traffic filtering.
>    There are quite some scenarios, however, SPFs (ACLs) are deployed in other client applications such as QoS policy and routing protocols (e.g. BGP and OSPF).
>    In most of these cases, SPF (ACL) is used for classification or filtering some routing information.
>    Would you consider to initiate a new draft dedicated to topics of applying SPF (ACL) to each type of targets?
>  
> 3. This document has had a detailed coverage on object-groups (both port object-groups and network object-groups).
>    Could we consider to put object-groups in a separate module?
>    The benefit of this practice is that it's easy for object-groups to be re-used by other modules besides SPF (ACL).
>  
> 4. The packet-capture feature may not be appropriate in SPF (ACL) module.
>    This feature actually introduces some new 'actions' to execute after we found a match between packet and SPE (ACE).
>    These actions (forward and copy) are not purely filtering actions. 
>    Therefore, they may not fit in the SPF (ACL) module very well.
>  
> 5. In current SPF (ACL) module, each SPE (ACE) is assigned a string as its name.
>    This may be too expensive in terms of memory consumption.
>    Instead, a sequence number for each entry should be sufficient and easy to implement.
>    Besides, sequence number does give uses the flexibilty to insert an entry to certain position of an existing SPF (ACL).
>  
> 6. Is it better to have a higher level abstraction above SPF (ACL) module?
>    By this, I mean creating a separate module that defines some common typedef/groupings.
>    And not container in this module.
>    Is this going to be an improvement for the modularity?
> 
>  
> Please let me know if there is any confusion on above points.
>  
>  
> Thanks
>  
> ---------------
> Yuekun Li
>  		 	   		  
> _______________________________________________
> netmod mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netmod

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>