Subject: [netmod] draft-ietf-netmod-acl-model

From: "Jon Shallow" <[email-masked]>
Date: Mon, 2 Oct 2017 17:38:50 +0100

Hi there,

I'm currently working on another draft ietf specification
(draft-ietf-dots-data-channel) which has a ordering requirement, but the
'ordered-by' statement is not specified (missing?)  for the 'list acl' in
container 'access-lists' in 4.1 IETF Access Control List
"[email-masked]". 

Container 'aces' has the 'ordered-by-user' statement for the list ACE.

      container aces {

        description

          "The access-list-entries container contains

           a list of access-list-entries(ACE).";

        list ace {

          key "rule-name";

          ordered-by user;

          description

            "List of access list entries(ACE)";

          .....           

Container 'access-lists' does not have the 'ordered-by-user' statement for
the list ACL.

  container access-lists {

    description

      "This is a top level container for Access Control Lists.

       It can have one or more Access Control Lists.";

    list acl {

      key "acl-type acl-name";

      description

        "An Access Control List(ACL) is an ordered list of

         Access List Entries (ACE). Each Access Control Entry has a

         list of match criteria and a list of actions.

         Since there are several kinds of Access Control Lists

         implemented with different attributes for

         different vendors, this

         model accommodates customizing Access Control Lists for

         each kind and for each vendor.";

      .......

Is there a good reason why 'list acl' is not defined as sortable?

- or is it defined elsewhere as being sortable?

- or is the intention that there can only be one ACL?

We potentially have a requirement for multiple ACLs, each with its own set
of sorted ACEs where the ACLs cannot be configured in a random order and
need to know how to move forward.

Regards

Jon

---

From: Mahesh Jethanandani <[email-masked]>
Date: Tue, 3 Oct 2017 16:56:55 -0700

Jon,

‘ordered-by user’ directive is useful to have on list of ACLs as/when they are applied. For example, in the latest published draft (-14) we added the 'ordered-by user’ statement to the list of ACLs when they are applied to the interfaces. You would not order the “global” ACLs list (under access-lists), because another interface may want a different order of ACLs. 

Does that help?

> On Oct 2, 2017, at 9:38 AM, Jon Shallow <[email-masked]> wrote:
> 
> Hi there,
>  
> I’m currently working on another draft ietf specification (draft-ietf-dots-data-channel) which has a ordering requirement, but the ‘ordered-by’ statement is not specified (missing?)  for the ‘list acl’ in container ‘access-lists’ in 4.1 IETF Access Control List "[email-masked] <mailto:[email-masked]>". 
>  
> Container ‘aces’ has the ‘ordered-by-user’ statement for the list ACE.
>       container aces {
>         description
> Container ‘access-lists’ does not have the ‘ordered-by-user’ statement for the list ACL.
>   container access-lists {
>     description
> Is there a good reason why ‘list acl’ is not defined as sortable?
> We potentially have a requirement for multiple ACLs, each with its own set of sorted ACEs where the ACLs cannot be configured in a random order and need to know how to move forward.
>  
> Regards
>  
> Jon
> _______________________________________________
> netmod mailing list
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/netmod <https://www.ietf.org/mailman/listinfo/netmod>
Mahesh Jethanandani
[email-masked]

---

From: "Jon Shallow" <[email-masked]>
Date: Thu, 5 Oct 2017 09:08:13 +0100

Hi Mahesh,

I think that we can with a bit of re-work, use the interfaces concept.  The clue that I had missed was in the (now deleted in -04) text in the following section.

A.2.  A company proprietary module example              

   Access control list typically does not exist in isolation.  Instead,

   they are associated with a certain scope in which they are applied,

   for example, an interface of a set of interfaces.  How to attach an

   access control list to an interface (or other system artifact) is

   outside the scope of this model, as it depends on the specifics of

   the system model that is being applied.  However, in general, the

   general design pattern will involved adding a data node with a

   reference, or set of references, to ACLs that are to be applied to

   the interface.  For this purpose, the type definition "access-

   control-list-ref" can be used.

Thanks for your help.

Regards

Jon

From: Mahesh Jethanandani [mailto: [email-masked]] 
Sent: 04 October 2017 00:57
To: Jon Shallow
Cc: [email-masked]
Subject: Re: [netmod] draft-ietf-netmod-acl-model

Jon,

Does that help?