Subject: [netmod] Can you remove the "Identity acl-base" defined in draft-ietf-netmod-acl-model-07

From: Linda Dunbar <[email-masked]>
Date: Tue, 10 May 2016 03:43:38 +0000

Dear Authors:

The "acl-base" identity defined in your draft is empty (i.e. only with a description) . Then you define "ipv4-acl" to be "acl-base". So basically you inherited the comments twice.

identity acl-base {
description
"Base Access Control List type for all Access Control List type
identifiers.";
}
identity ipv4-acl {
base acl:acl-base;
description
"ACL that primarily matches on fields from the IPv4 header
(e.g. IPv4 destination address) and layer 4 headers (e.g. TCP
destination port). An acl of type ipv4-acl does not contain
matches on fields in the ethernet header or the IPv6 header.";
}
identity ipv6-acl {
base acl:acl-base;
description
"ACL that primarily matches on fields from the IPv6 header
(e.g. IPv6 destination address) and layer 4 headers (e.g. TCP
destination port). An acl of type ipv6-acl does not contain
matches on fields in the ethernet header or the IPv4 header.";
}

You really don't need to define the "acl-base". What is the impact if defining the "ipv4-acl" and "ipv6-acl" as follows?

identity ipv4-acl {
   description
   "ACL that primarily matches on fields from the IPv4 header
   (e.g. IPv4 destination address) and layer 4 headers (e.g. TCP
   destination port). An acl of type ipv4-acl does not contain
   matches on fields in the ethernet header or the IPv6 header.";
}
identity ipv6-acl {
   description
   "ACL that primarily matches on fields from the IPv6 header
   (e.g. IPv6 destination address) and layer 4 headers (e.g. TCP
   destination port). An acl of type ipv6-acl does not contain
   matches on fields in the ethernet header or the IPv4 header.";
}

Thanks, Linda Dunbar

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Tue, 10 May 2016 06:24:11 +0200

Linda,

the identityref type in YANG can be scoped to a base identity. This
allows to restrict an indentityref to a certain set of identities.
See 6020 section 7.16.3 and section 9.10.5 for an example.

The ACL draft follows the model described in RFC 6020 and defines

     typedef acl-type {
       type identityref {
         base acl-base;
       }
     }

which restricts acl-type to any identity directly or indirectly
derived from acl-base. If you remove acl-base, then acl-type could
refer to any identity, which includes identities that have nothing
to do with ACLs.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1 | 28759 Bremen | Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

---

From: Linda Dunbar <[email-masked]>
Date: Tue, 10 May 2016 15:07:30 +0000

Juergen,

If "acl-base" has some content more than the comment (i.e. the description), then it makes sense.  

The comments in the "identity ipv4-acl" is enough to describe the identity. Same with the identity ipv6-acl. 

I find it is very confusing to have the recursive reference of identity (all of them are simply the description). 

My two cents, 

Linda 

-----Original Message-----
From: Juergen Schoenwaelder [mailto:[email-masked]] 
Sent: Monday, May 09, 2016 11:24 PM
To: Linda Dunbar
Cc: [email-masked]; [email-masked]'; Thomas D. Nadeau
Subject: Re: Can you remove the "Identity acl-base" defined in draft-ietf-netmod-acl-model-07

Linda,

the identityref type in YANG can be scoped to a base identity. This allows to restrict an indentityref to a certain set of identities.
See 6020 section 7.16.3 and section 9.10.5 for an example.

     typedef acl-type {
       type identityref {
         base acl-base;
       }
     }

which restricts acl-type to any identity directly or indirectly derived from acl-base. If you remove acl-base, then acl-type could refer to any identity, which includes identities that have nothing to do with ACLs.

/js

On Tue, May 10, 2016 at 03:43:38AM +0000, Linda Dunbar wrote:
> identifiers."; } identity ipv4-acl { base acl:acl-base; description 
> "ACL that primarily matches on fields from the IPv4 header (e.g. IPv4 
> destination address) and layer 4 headers (e.g. TCP destination port). 
> An acl of type ipv4-acl does not contain matches on fields in the 
> ethernet header or the IPv6 header."; } identity ipv6-acl { base 
> acl:acl-base; description "ACL that primarily matches on fields from 
> the IPv6 header (e.g. IPv6 destination address) and layer 4 headers 
> (e.g. TCP destination port). An acl of type ipv6-acl does not contain 
> matches on fields in the ethernet header or the IPv4 header."; }
> 
> 
>    matches on fields in the ethernet header or the IPv6 header."; } 
> identity ipv6-acl {
>    description
>    matches on fields in the ethernet header or the IPv4 header."; }
> 
> 
> Thanks, Linda Dunbar

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Tue, 10 May 2016 17:37:37 +0200

> I find it is very confusing to have the recursive reference of identity (all of them are simply the description). 

I fail to see anything confusing here. Did you read the relevant
sections of RFC 6020? What is unclear about identities and how they
work?

/js

---

From: Linda Dunbar <[email-masked]>
Date: Tue, 10 May 2016 16:55:41 +0000

Juergen, 

Of course, it is not confusing to you because you are in the box (vs. many of us are outside the box looking in). 

RFC 6020 doesn't say all identities have to have a sub-identity. 

My opinion only. 

Linda 

-----Original Message-----
From: Juergen Schoenwaelder [mailto:[email-masked]] 
Sent: Tuesday, May 10, 2016 10:38 AM
To: Linda Dunbar
Cc: [email-masked]; [email-masked]'; Thomas D. Nadeau
Subject: Re: Can you remove the "Identity acl-base" defined in draft-ietf-netmod-acl-model-07

> I find it is very confusing to have the recursive reference of identity (all of them are simply the description). 

I fail to see anything confusing here. Did you read the relevant sections of RFC 6020? What is unclear about identities and how they work?

/js

---

From: "Lisa (Yi) Huang" <[email-masked]>
Date: Tue, 10 May 2016 17:05:52 +0000

Linda,

Could you elaborate what difficulty you are facing?

The draft defines

typedef acl-type {
  type identityref {
   base acl-base;
  }
     }

This allows the acl-type to be ipv4-acl or ipv6-acl, or other new types
that inherit from acl-type.

Hope this helps.

Thanks,
Lisa

On 5/10/16, 9:55 AM, "Linda Dunbar" <[email-masked]> wrote:

>Juergen, 
>
>Of course, it is not confusing to you because you are in the box (vs.
>many of us are outside the box looking in).
>
>> The comments in the "identity ipv4-acl" is enough to describe the
>>identity. Same with the identity ipv6-acl.
>> 
>> I find it is very confusing to have the recursive reference of identity
>>(all of them are simply the description).
>>
>
>I fail to see anything confusing here. Did you read the relevant sections
>of RFC 6020? What is unclear about identities and how they work?
>
>/js
>
>--

---

From: Andy Bierman <[email-masked]>
Date: Tue, 10 May 2016 10:16:57 -0700

> RFC 6020 doesn't say all identities have to have a sub-identity.

This is how YANG does strong typing for identities.
It allows the compiler to check the identity being used for a given
identityref leaf.   Otherwise the identities meant for completely different
purposes could not be screened by the compiler

     leaf transport {
        type identityref {
           base transport-protocol;
         }
      }

     leaf toast-type {
        type identityref {
           base bread-type;
         }
      }

> Linda

Andy

> _______________________________________________
> netmod mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netmod
>

---

From: Robert Wilton <[email-masked]>
Date: Tue, 10 May 2016 18:27:02 +0100

Hi Linda,

I think that having the base identity makes the model safer and more 
extensible in future.  I think that the general idea of a base identity 
is fairly standard and is perhaps a bit like defining an abstract base 
class in an OO language.

So, in YANG, rather than a when statement having to explicitly check for 
ipv4-acl or ipv6-acl it can just check for any type derived from 
acl-base, which allows for new types of ACL to be defined in future 
(potentially in different modules).

Conversely, it also helps prevent someone from using a completely 
inappropriate identity, e.g. say trying to use an interface type 
identity such as ift:ethernetCsmacd where a type of ACL identity is 
required.

Thanks,
Rob

---

From: Linda Dunbar <[email-masked]>
Date: Tue, 10 May 2016 17:27:24 +0000

Lisa, 

My difficulty was not being able to see the value of one comment based on another comment. 

Now I understand it is really just personal preference. Having an extra step doesn't hurt the bottom line end result. It is Ok. 

Linda

-----Original Message-----
From: Lisa (Yi) Huang [mailto:[email-masked]] 
Sent: Tuesday, May 10, 2016 12:06 PM
To: Linda Dunbar; Juergen Schoenwaelder
Cc: [email-masked]; [email-masked]'; Thomas D. Nadeau
Subject: Re: Can you remove the "Identity acl-base" defined in draft-ietf-netmod-acl-model-07

Linda,

The draft defines

typedef acl-type {
  type identityref {
   base acl-base;
  }
     }

This allows the acl-type to be ipv4-acl or ipv6-acl, or other new types that inherit from acl-type.

Hope this helps.

Thanks,
Lisa

On 5/10/16, 9:55 AM, "Linda Dunbar" <[email-masked]> wrote:

>From: Juergen Schoenwaelder 
>[mailto:[email-masked]]
>> I find it is very confusing to have the recursive reference of 
>>identity (all of them are simply the description).
>>
>
>sections of RFC 6020? What is unclear about identities and how they work?
>
>/js
>
>--

---

From: Nadeau Thomas <[email-masked]>
Date: Tue, 10 May 2016 14:17:31 -0400

Yea, I agree that its probably worth giving a little more latitude when helping people with models. 8)

	—Tom

> On May 10, 2016:12:55 PM, at 12:55 PM, Linda Dunbar <[email-masked]> wrote:
> 
> Juergen, 
>

---

From: Dean Bogdanovic <[email-masked]>
Date: Tue, 10 May 2016 14:58:20 -0400

Tom,

It is how YANG does strong typing for  identities. Please see Andy’s email

Dean

> On May 10, 2016, at 2:17 PM, Nadeau Thomas <[email-masked]> wrote:
> 
>

---

From: Nadeau Thomas <[email-masked]>
Date: Tue, 10 May 2016 15:31:10 -0400

I understand. I was just pointing out that we might want to be a little more collegial with people seeking help with models. 

	—Tom

> On May 10, 2016:2:58 PM, at 2:58 PM, Dean Bogdanovic <[email-masked]> wrote:
> 
> Tom,
>

---

From: William Ivory <[email-masked]>
Date: Wed, 11 May 2016 08:19:01 +0000

Hi Rob,

Probably a stupid question but how would you write a 'when' statement that checks identity type?  What XPATH function / expression would allow you to access the YANG type?

Thanks,

William

-----Original Message-----
From: netmod [mailto:[email-masked]] On Behalf Of Robert Wilton
Sent: 10 May 2016 18:27
To: Linda Dunbar <[email-masked]>
Cc: [email-masked]; [email-masked]' <[email-masked]>
Subject: Re: [netmod] Can you remove the "Identity acl-base" defined in draft-ietf-netmod-acl-model-07

Hi Linda,

I think that having the base identity makes the model safer and more extensible in future.  I think that the general idea of a base identity is fairly standard and is perhaps a bit like defining an abstract base class in an OO language.

So, in YANG, rather than a when statement having to explicitly check for ipv4-acl or ipv6-acl it can just check for any type derived from acl-base, which allows for new types of ACL to be defined in future (potentially in different modules).

Conversely, it also helps prevent someone from using a completely inappropriate identity, e.g. say trying to use an interface type identity such as ift:ethernetCsmacd where a type of ACL identity is required.

Thanks,
Rob

_______________________________________________
netmod mailing list
[email-masked]
https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_netmod&d=CwICAg&c=IL_XqQWOjubgfqINi2jTzg&r=GByLeg9jZvOv_AlgBo9uvdDrxizlOR7l_SnTXowyJU8&m=MlQZEKdXoP4IwlPcElVo_hIsmcgPxkS1AvAc3uGRU_E&s=iht1ryWsM95ONkVXCHgLCn-rGgsZVjmO0P_Hnhg2llM&e=

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Wed, 11 May 2016 10:28:10 +0200

YANG 1.1 introduces special functions for identities such as
derived-from() or derived-from-or-self(), for more details see section
10.4 of draft-ietf-netmod-rfc6020bis-12.

/js

---

From: William Ivory <[email-masked]>
Date: Wed, 11 May 2016 08:40:04 +0000

Thanks - had forgotten those YANG 1.1 extensions.

William

-----Original Message-----
From: Juergen Schoenwaelder [mailto:[email-masked]] 
Sent: 11 May 2016 09:28
To: William Ivory <[email-masked]>
Cc: Robert Wilton <[email-masked]>; Linda Dunbar <[email-masked]>; [email-masked]; [email-masked]' <[email-masked]>
Subject: Re: [netmod] Can you remove the "Identity acl-base" defined in draft-ietf-netmod-acl-model-07

/js

On Wed, May 11, 2016 at 08:19:01AM +0000, William Ivory wrote:
> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_netmod&d=CwIBAg&c=IL_XqQWOjubgfqINi2jTzg&r=GByLeg9jZvOv_AlgBo9uvdDrxizlOR7l_SnTXowyJU8&m=9SqA4lSC3_C0sr1ZX9Wd7wI8KYym05LqlsRSMn9nS0k&s=VTDyjdlJ_E4CVhRCNWy3hNeKwtWozq2hfJn5IvnwR7g&e= 

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1 | 28759 Bremen | Germany
Fax:   +49 421 200 3103         <https://urldefense.proofpoint.com/v2/url?u=http-3A__www.jacobs-2Duniversity.de_&d=CwIBAg&c=IL_XqQWOjubgfqINi2jTzg&r=GByLeg9jZvOv_AlgBo9uvdDrxizlOR7l_SnTXowyJU8&m=9SqA4lSC3_C0sr1ZX9Wd7wI8KYym05LqlsRSMn9nS0k&s=7LK8I-xuJJL1uj0aFRdbOMusbTZca15C8vQj8wDcs0U&e= >