Subject: Re: [netmod] Call for consensus to Accept ACL Model draft-bogdanovic-netmod-acl-model-02 as a WG draft

From: "Dana Blair (dblair)" <[email-masked]>
Date: Mon, 20 Oct 2014 13:33:40 +0000

The authors met and this is the their consolidated response.  Look for DLB:

Authors,

I have reviewed the document and have two rather fundamental comments that preclude me from supporting WG adoption.

    1. I think you should change the rule-name (type string) to a sequence-number (type uint16 or int32). While using a string is ostensibly more flexible, network administrators have been using sequence numbers for over 30 years now and will be throughly disappointed when they discover that ACE “10” lexicographically precedes ACE “2”.  This comment has broader significance than just access lists since this model, if adopted and standardized, will set a precedent for future models.

DLB:  This was discuss extensively among the authors.  The conclusion was not to add sequence numbers since it would essentially result in making the model unworkable with 2 mutually exclusive keys. See Andy’s comment  "The IETF data model cannot do both.” on 10/15.

The problem with sequence-number key is insertion.  While the sequence number is widely used, it has a historical problem of how to insert a new entry between two adjacent sequence numbers.  IOW, how to insert a new entry between sequence N and N+1.   There is no sequence number between N and N+1 which can be used for the new entry.

The options:

A.  A vendor can use a proprietary augmentation.  There is no restriction here.

B.  Propose a pyang —ietf compilable augmentation.  However, to be considered for the draft and hopefully ultimate standardization, the augmentation must solve the insertion problem mentioned above.

    2. Please remove section 5 from the draft. This draft should not mix packet filtering and route filtering. Though we may get to this hierarchy, I believe that prefix-lists have much greater affinity with other routing policies  than access-lists. Note that there is a separate route-filtering model in https://datatracker.ietf.org/doc/draft-zhdankin-netmod-bgp-cfg/. Finally, the RTGWG is now chartered for YANG models that are not specific to other Routing area working groups. The discussion of route filters belongs there or in IDR (since BGP has the most rigorous routing policy requirements).

DLB:  We’ll update the draft to mention this is an example.   And also take a look at the route filter model.

Also, a comparably minor comment, leaf-list targets requires a better definition. It really isn’t very useful without some guidance as to how an implementation’s targets should be represented.

DLB:  Agreed it needs a better definition.  We’ll look into this for the next version.  For example, A proposal for interface target would help move this along.

Thanks,
Acee

On Oct 8, 2014, at 11:14 AM, Thomas D. Nadeau <tnadeau at lucidvision.com> wrote:

>
>       The co-authors of draft-bogdanovic-netmod-acl-model-02 have asked the NETMOD chairs to post a call to adopt the draft as a WG document.
>
>       The draft can be found here:
>
>       http://tools.ietf.org/html/draft-bogdanovic-netmod-acl-model-02
>
>       The model itself has been extracted and can be directly accessed here using git:
>
>       https://github.com/YangModels/yang/blob/master/experimental/ietf/ACL-MODEL/
>
>       Please comment by the close of business on Monday, October 13, 2014.
>
>
>       --Tom (As NETMOD co-chair)
>
>
>
> _______________________________________________
> netmod mailing list
> netmod at ietf.org
> https://www.ietf.org/mailman/listinfo/netmod

---

From: "Acee Lindem (acee)" <[email-masked]>
Date: Mon, 20 Oct 2014 17:01:51 +0000

Hi Dana, et al, 

Thank you for considering my comments. I now support adoption of the draft
as a netmod WG document. With respect to #1, I can envision ways that the
³order-by user² could be implemented for sequence-number ordered ACLs but
they do not eliminate insertion complexities.

Thanks,
Acee 

On 10/20/14, 9:33 AM, "Dana Blair (dblair)" <[email-masked]> wrote:

>I have reviewed the document and have two rather fundamental comments
>that preclude me from supporting WG adoption.
>
>    1. I think you should change the rule-name (type string) to a
>sequence-number (type uint16 or int32). While using a string is
>ostensibly more flexible, network administrators have been using sequence
>numbers for over 30 years now and will be throughly disappointed when
>they discover that ACE ³10² lexicographically precedes ACE ³2².  This
>comment has broader significance than just access lists since this model,
>if adopted and standardized, will set a precedent for future models.
>
>DLB:  This was discuss extensively among the authors.  The conclusion was
>not to add sequence numbers since it would essentially result in making
>the model unworkable with 2 mutually exclusive keys. See Andy¹s comment
>"The IETF data model cannot do both.² on 10/15.  The problem with
>sequence-number key is insertion.  While the sequence number is widely
>used, it has a historical problem of how to insert a new entry between
>two adjacent sequence numbers.  IOW, how to insert a new entry between
>sequence N and N+1.   There is no sequence number between N and N+1 which
>can be used for the new entry.The options:  A.  A vendor can use a
>proprietary augmentation.  There is no restriction here.B.  Propose a
>pyang ‹ietf compilable augmentation.  However, to be considered for the
>draft and hopefully ultimate standardization, the augmentation must solve
>the insertion problem mentioned above.    2. Please remove section 5 from
>the draft. This draft should not mix packet filtering and route
>filtering. Though we may get to this hierarchy, I believe that
>prefix-lists have much greater affinity with other routing policies  than
>access-lists. Note that there is a separate route-filtering model in
>https://datatracker.ietf.org/doc/draft-zhdankin-netmod-bgp-cfg/. Finally,
>the RTGWG is now chartered for YANG models that are not specific to other
>Routing area working groups. The discussion of route filters belongs
>there or in IDR (since BGP has the most rigorous routing policy
>requirements). 
>
>DLB:  We¹ll update the draft to mention this is an example.   And also
>take a look at the route filter model.Also, a comparably minor comment,
>leaf-list targets requires a better definition. It really isn¹t very
>useful without some guidance as to how an implementation¹s targets should
>be represented. DLB:  Agreed it needs a better definition.  We¹ll look
>into this for the next version.  For example, A proposal for interface
>target would help move this along.Thanks,
>Acee 
>    
>
>
>> 	The co-authors of draft-bogdanovic-netmod-acl-model-02 have asked the
>>NETMOD chairs to post a call to adopt the draft as a WG document.
>>