Subject: Re: [netmod] WG Last Call: draft-ietf-netmod-acl-model-14

From: Kent Watsen <[email-masked]>
Date: Mon, 6 Nov 2017 19:16:11 +0000

This closes the Last Call on this document.  There is
clearly a lot of interest in the publication of an ACL
model, but there also seems to be significant concern
for how this model is structured.  It seems that we need
to spend some more time to ensure the current structure
is okay.  Based on the result of this discussion, we
will then judge if this Last Call was successful of not.

Thanks,
Kent // shepherd

--

All,

This starts a two-week working group last call on
draft-ietf-netmod-acl-model-14.

The working group last call ends on November 3.
Please send your comments to the netmod mailing list.

Positive comments, e.g., "I've reviewed this document
and believe it is ready for publication", are welcome!
This is useful and important, even from authors.

Could the authors, explicitly CC-ed on this email, please
also confirm at this time that they are unaware of any 
IPR related to this draft.

Thank you,
Netmod Chairs

_______________________________________________
netmod mailing list
[email-masked]
https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_netmod&d=DwICAg&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=9zkP0xnJUvZGJ9EPoOH7Yhqn2gsBYaGTvjISlaJdcZo&m=HCp9pNO1eASC7fBxrsD4hOUjTXHbKMuWC5C2h7-ym68&s=k7uRdiuP0Z8vvDa1hOLxdQJQt3MBpHv8gcuHg9hy-Lw&e=

---

From: Eliot Lear <[email-masked]>
Date: Tue, 7 Nov 2017 18:24:10 +0530

Kent,

Can you or the chairs please summarize what issues need to be
addressed?  We are in a place where we end up in endless last calls, and
that is bad.

Eliot

On 11/7/17 12:46 AM, Kent Watsen wrote:
> https://www.ietf.org/mailman/listinfo/netmod
>

---

From: Kristian Larsson <[email-masked]>
Date: Wed, 8 Nov 2017 17:43:14 +0100

> will then judge if this Last Call was successful of not.

I've probably ignited the most recent debate on this model. I'm
sorry for prolonging the process and preventing moving into RFC
but I really am not comfortable with the current structure.

Besides the structure, which is perhaps more subjective, I think
the model contains actual errors. For example, it appears that
there should be stats entries at the interface attachment points
but that data is config true and not config false and the leafref
doesn't match on the acl-type&acl-name so it could point to any
acl-rule!? It's possible to match on conflicting data, like IPv4
and IPv6 or TCP and UDP in the same ACE, which just doesn't make
any sense at all. There is a match on interface but it is not
clear if this is ingress or egress interface. any-acl is empty!?

I am working on a couple of concrete suggestions for making a
more elegant model.

   kll

-- 
Kristian Larsson                                        KLL-RIPE
+46 72 5479985                                [email-masked]