Subject: [netmod] Call for consensus to Accept ACL Model draft-bogdanovic-netmod-acl-model-02 as a WG draft

From: "Thomas D. Nadeau" <[email-masked]>
Date: Wed, 8 Oct 2014 08:14:34 -0700

The co-authors of draft-bogdanovic-netmod-acl-model-02 have asked the NETMOD chairs to post a call to adopt the draft as a WG document. 

	The draft can be found here:

	http://tools.ietf.org/html/draft-bogdanovic-netmod-acl-model-02

	The model itself has been extracted and can be directly accessed here using git:

	https://github.com/YangModels/yang/blob/master/experimental/ietf/ACL-MODEL/

	Please comment by the close of business on Monday, October 13, 2014.

	--Tom (As NETMOD co-chair)

---

From: "Acee Lindem (acee)" <[email-masked]>
Date: Fri, 10 Oct 2014 01:16:21 +0000

Authors, 

I have reviewed the document and have two rather fundamental comments that preclude me from supporting WG adoption. 

    1. I think you should change the rule-name (type string) to a sequence-number (type uint16 or int32). While using a string is ostensibly more flexible, network administrators have been using sequence numbers for over 30 years now and will be throughly disappointed when they discover that ACE “10” lexicographically precedes ACE “2”.  This comment has broader significance than just access lists since this model, if adopted and standardized, will set a precedent for future models. 
    2. Please remove section 5 from the draft. This draft should not mix packet filtering and route filtering. Though we may get to this hierarchy, I believe that prefix-lists have much greater affinity with other routing policies  than access-lists. Note that there is a separate route-filtering model in https://datatracker.ietf.org/doc/draft-zhdankin-netmod-bgp-cfg/. Finally, the RTGWG is now chartered for YANG models that are not specific to other Routing area working groups. The discussion of route filters belongs there or in IDR (since BGP has the most rigorous routing policy requirements). 

Also, a comparably minor comment, leaf-list targets requires a better definition. It really isn’t very useful without some guidance as to how an implementation’s targets should be represented. 

Thanks,
Acee 

On Oct 8, 2014, at 11:14 AM, Thomas D. Nadeau <[email-masked]> wrote:

> _______________________________________________
> netmod mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netmod

---

From: Dean Bogdanovic <[email-masked]>
Date: Fri, 10 Oct 2014 13:17:42 +0000

>    1. I think you should change the rule-name (type string) to a sequence-number (type uint16 or int32). While using a string is ostensibly more flexible, network administrators have been using seq…

Well, this is something we posted on the mailing list to ask opinions. Problem with the sequence number is that inserting new entries is a problem if the space is exhausted between entries. The rule-name type string is more flexible then a sequence number.

>    2. Please remove section 5 from the draft. This draft should not mix packet filtering and route filtering. Though we may get to this hierarchy, I believe that prefix-lists have much greater affi…

This is just an example how to add standard extensions. We needed a basic example how to extend standard features and as you can see it is a bare minimum.  Maybe enforcing language that this is solely an example would help?

Dean

---

From: "Acee Lindem (acee)" <[email-masked]>
Date: Fri, 10 Oct 2014 15:13:25 +0000

Hi Dean, 

On 10/10/14, 9:17 AM, "Dean Bogdanovic" <[email-masked]> wrote:

>> I have reviewed the document and have two rather fundamental comments
>>that preclude me from supporting WG adoption.
>> 
>>    1. I think you should change the rule-name (type string) to a
>>sequence-number (type uint16 or int32). While using a string is
>>ostensibly more flexible, network administrators have been using
>>sequence numbers for over 30 years now and will be throughly
>>disappointed when they discover that ACE ³10² lexicographically precedes
>>ACE ³2².  This comment has broader significance than just access lists
>>since this model, if adopted and standardized, will set a precedent for
>>future models. 
>
>Well, this is something we posted on the mailing list to ask opinions.

I¹ll have to look in the archives. Was the rule-name string given support
or simply no opposition?

> Problem with the sequence number is that inserting new entries is a
>problem if the space is exhausted between entries. The rule-name type
>string is more flexible then a sequence number.

Like I said, list based policies have used sequence numbers for over 30
years and this has not proved to be a serious problem. I don¹t think we
should change semantics with so little benefit when modeling existing
constructs. For something completely new, these new ordering semantics
could be explored. If I¹m the only one who sees this as unwieldy, I¹ll
concede. I¹ve auto-generated many configs with number based interface
names or VRFs and been really annoyed at the sorted ordering.

>
>>    2. Please remove section 5 from the draft. This draft should not mix
>>packet filtering and route filtering. Though we may get to this
>>hierarchy, I believe that prefix-lists have much greater affinity with
>>other routing policies  than access-lists. Note that there is a separate
>>route-filtering model in
>>https://datatracker.ietf.org/doc/draft-zhdankin-netmod-bgp-cfg/.
>>Finally, the RTGWG is now chartered for YANG models that are not
>>specific to other Routing area working groups. The discussion of route
>>filters belongs there or in IDR (since BGP has the most rigorous routing
>>policy requirements).
>
>This is just an example how to add standard extensions. We needed a basic
>example how to extend standard features and as you can see it is a bare
>minimum.  Maybe enforcing language that this is solely an example would
>help?

I didn¹t notice that it was an example. I think this needs to be more
clear - maybe even moved to an appendix. However, I¹m happy as long as it
is not normative. 

Thanks,
Acee 

>
>Dean
>
>> 
>> Also, a comparably minor comment, leaf-list targets requires a better
>>definition. It really isn¹t very useful without some guidance as to how
>>an implementation¹s targets should be represented.
>> 
>> Thanks,
>> Acee 
>> 
>> 
>> 
>>> 	The co-authors of draft-bogdanovic-netmod-acl-model-02 have asked the
>>>NETMOD chairs to post a call to adopt the draft as a WG document.
>>>

---

From: Andy Bierman <[email-masked]>
Date: Fri, 10 Oct 2014 08:53:38 -0700

> names or VRFs and been really annoyed at the sorted ordering.

But this is YANG, not CLI.
YANG has user-ordered lists so the keys do not have to be used
to dictate an order (and should not be used).  The keys can be
used to describe the entry, so "9" and "10" are just labels.
They sort correctly because the list is ordered-by user and the user
knows that, and is expected to provide or insert entries in the desired
order.

Andy

> >>>     The model itself has been extracted and can be directly accessed
> here
> >>>using git:
> >>>
> >>>
> >>>

---

From: Mahesh Jethanandani <[email-masked]>
Date: Fri, 10 Oct 2014 11:36:04 -0700

> names or VRFs and been really annoyed at the sorted ordering.

But the ACE is a ordered-by user list. If you do not the like the order YANG generates, reorder it.

Mahesh Jethanandani
[email-masked]

---

From: Andy Bierman <[email-masked]>
Date: Fri, 10 Oct 2014 11:59:46 -0700

> YANG generates, reorder it.

YANG does not generate an order.
YANG just says whether the entry order provided by the client in edit
requests is
significant or not.  Some NETCONF servers will sort system-ordered entries,
if configured that way, but YANG does not require any particular ordering
for those entries.

For a list that is ordered-by user, the order is totally up to the client.
By default, new user-ordered entries are added last (after existing
entries in the target datastore).  The order these entries are provided
in XML instance documents (e.g. <edit-config>) must be maintained by the
server.
In JSON the array order must be preserved.

Andy

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Fri, 10 Oct 2014 23:32:12 +0200

> In JSON the array order must be preserved.

Are you sure draft-ietf-netmod-yang-json-00.txt says this? If not,
make sure that Lada adds this as an open issue or an edit request.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

---

From: Andy Bierman <[email-masked]>
Date: Fri, 10 Oct 2014 14:37:34 -0700

> make sure that Lada adds this as an open issue or an edit request.
I just checked sec 3.2.3 and 3.2.4.
There is no mention of 'ordered-by user' for leaf-list or list statements.
Lada, add as an open issue...

/js
Andy

---

From: "Acee Lindem (acee)" <[email-masked]>
Date: Fri, 10 Oct 2014 21:56:21 +0000

From: Andy Bierman <[email-masked]<mailto:[email-masked]>>
Date: Friday, October 10, 2014 at 11:53 AM
To: Acee Lindem <[email-masked]<mailto:[email-masked]>>
Cc: Dean Bogdanovic <[email-masked]<mailto:[email-masked]>>, NETMOD Working Group <[email-masked]<mailto:[email-masked]>>
Subject: Re: [netmod] Call for consensus to Accept ACL Model draft-bogdanovic-netmod-acl-model-02 as a WG draft

On Fri, Oct 10, 2014 at 8:13 AM, Acee Lindem (acee) <[email-masked]<mailto:[email-masked]>> wrote:
Hi Dean,

On 10/10/14, 9:17 AM, "Dean Bogdanovic" <[email-masked]<mailto:[email-masked]>> wrote:

>
>On Oct 9, 2014, at 9:16 PM, Acee Lindem (acee) <[email-masked]<mailto:[email-masked]>> wrote:
>
>> Authors,
>>

knows that, and is expected to provide or insert entries in the desired order.

Okay – I missed this distinction but understand it now. Can we then add a sequence-number to the model that an implementation knows how to order the ACEs?
Thanks,
Acee

Andy

Thanks,
Acee

>> On Oct 8, 2014, at 11:14 AM, Thomas D. Nadeau <[email-masked]<mailto:[email-masked]>>
>>wrote:
>>
>>>
>>> [email-masked]<mailto:[email-masked]>
>> [email-masked]<mailto:[email-masked]>

_______________________________________________
netmod mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/netmod

---

From: Dean Bogdanovic <[email-masked]>
Date: Wed, 15 Oct 2014 00:25:12 +0000

On Oct 10, 2014, at 5:56 PM, Acee Lindem (acee) <[email-masked]<mailto:[email-masked]>> wrote:

You can easily make a proprietary extension based on the newco example. There is nothing preventing you to do that.

Dean

Andy

Thanks,
Acee

---

From: "Acee Lindem (acee)" <[email-masked]>
Date: Wed, 15 Oct 2014 17:01:25 +0000

From: Dean Bogdanovic <[email-masked]<mailto:[email-masked]>>
Date: Tuesday, October 14, 2014 at 8:25 PM
To: Acee Lindem <[email-masked]<mailto:[email-masked]>>
Cc: Andy Bierman <[email-masked]<mailto:[email-masked]>>, NETMOD Working Group <[email-masked]<mailto:[email-masked]>>
Subject: Re: [netmod] Call for consensus to Accept ACL Model draft-bogdanovic-netmod-acl-model-02 as a WG draft

Or we could make the IETF ACL model semantics match those of at least 90% of the world’s extant access-lists. There is also nothing preventing the us from doing that. Why would we want to do anything different? In fact, we could support both the real world ACL semantics and the current proposal.

     leaf rule-name-number {
          type union {
                type uint16;
                type string;
          }
     }

Thanks,
Acee

Dean

Andy

Thanks,
Acee

---

From: Andy Bierman <[email-masked]>
Date: Wed, 15 Oct 2014 10:14:35 -0700

On Wed, Oct 15, 2014 at 10:01 AM, Acee Lindem (acee) <[email-masked]> wrote:

>
>
>   From: Dean Bogdanovic <[email-masked]>
> To: Acee Lindem <[email-masked]>
> Cc: Andy Bierman <[email-masked]>, NETMOD Working Group <
> [email-masked]>
> Subject: Re: [netmod] Call for consensus to Accept ACL Model
> draft-bogdanovic-netmod-acl-model-02 as a WG draft
>
>
>  On Oct 10, 2014, at 5:56 PM, Acee Lindem (acee) <[email-masked]> wrote:
>
>
>
>   From: Andy Bierman <[email-masked]>
> To: Acee Lindem <[email-masked]>
> Cc: Dean Bogdanovic <[email-masked]>, NETMOD Working Group <
> [email-masked]>
> Subject: Re: [netmod] Call for consensus to Accept ACL Model
> draft-bogdanovic-netmod-acl-model-02 as a WG draft
>
>
>
>  Okay - I missed this distinction but understand it now. Can we then add
> a sequence-number to the model that an implementation knows how to order
> the ACEs?
> Thanks,
> Acee
>
>
>  You can easily make a proprietary extension based on the newco example.
> There is nothing preventing you to do that.
>
>
>  Or we could make the IETF ACL model semantics match those of at least
> 90% of the world's extant access-lists. There is also nothing preventing
> the us from doing that. Why would we want to do anything different? In
> fact, we could support both the real world ACL semantics and the current
> proposal.
>
>       leaf rule-name-number {
>           type union {
>                 type uint16;
>                 type string;
>           }
>      }
>
>
The IETF data model cannot do both.
Either the list is ordered-by user and there are no sequence numbers,
or the list is ordered-by system and the sequence numbers determine the
execution order. A leaf augmenting the standard data model cannot override
the ordered-by user semantics.

Keep in mind that NETCONF does not have a "rename" operation, so
if this leaf is used in the key, then making room for a new entry
means deleting the old entries and recreating them with new keys.

An M2M API should be able to handle ordered-by user just fine,
but if the CLI is also used to configure the same data model,
then sequence numbers would be needed.  In this case, I think
backward compatibility with CLI is more important than more elegant YANG
usage, so the 'rule-name-number' proposal is OK (w/ ordered-by system).

 Thanks,

Andy

>> >> On Oct 8, 2014, at 11:14 AM, Thomas D. Nadeau <[email-masked]
>> >
>> >>wrote:
>> >>
>> >>>

---

From: Ladislav Lhotka <[email-masked]>
Date: Thu, 16 Oct 2014 15:31:22 +0200

> Lada, add as an open issue...

Done:

https://github.com/yang-json/yang-json/issues/1

Lada

-- 
Ladislav Lhotka, CZ.NIC Labs
PGP Key ID: E74E8C0C