Subject: Re: [netmod] [email-masked] : Can access-lists use a grouping?

From: Mahesh Jethanandani <[email-masked]>
Date: Thu, 2 Nov 2017 10:02:30 +0630

Ranga,

Is there a reason why you do not want to consider augmenting the model, particularly since you seem to want to use the entire model?

> On Oct 31, 2017, at 8:39 PM, M. Ranganathan <[email-masked]> wrote:
> 
> Re-posted from OPSAWG list :
> 
> 
> Hello,
> 
> In the file  
> 
> [email-masked]
> 
> I see that access-lists is directly defined as a collection.
> 
> 
> May I suggest making a grouping (say access-lists-grouping) and use a "uses" statement in access-lists.
> 
> The use-case for this change request - I would like to use the grouping in another YANG model using a "uses" statement.
> 
> Thanks in advance for considering it.
> 
> Regards,
> 
> Ranga.
> 
> -- 
> M. Ranganathan
> _______________________________________________
> netmod mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netmod

Mahesh Jethanandani
[email-masked]

---

From: "M. Ranganathan" <[email-masked]>
Date: Thu, 2 Nov 2017 10:50:09 -0400

Hi Mahesh,

On Wed, Nov 1, 2017 at 11:32 PM, Mahesh Jethanandani <
[email-masked]> wrote:

> Ranga,
>
> Is there a reason why you do not want to consider augmenting the model,
> particularly since you seem to want to use the entire model?
>

Yes. I want to include other metadata (specifically MUD + other management
data modeled using YANG) associated with the ACL in a container in my own
model. For this I want to import access-lists from the ACL YANG model but
as it currently stands, I can't.

With the way it has been defined (i.e. as a container and not a grouping),
I cannot include it in another YANG model. It would be perfect if the
access-lists could be made into a grouping as suggested. Nothing else needs
to change as far as I am concerned.

Thanks!

Regards,

Ranga.

> > The use-case for this change request - I would like to use the grouping
> in another YANG model using a "uses" statement.
> >

-- 
M. Ranganathan

---

From: Robert Wilton <[email-masked]>
Date: Thu, 2 Nov 2017 15:00:48 +0000

Hi Ranga,

Presumably another choice would to keep ACLs defined in one place (i.e. 
no grouping required), augment with ACL model with your extra MUD + 
other mgmt data, and then have a reference to that ACL from your model.

Thanks,
Rob

On 02/11/2017 14:50, M. Ranganathan wrote:
> Hi Mahesh,
>
>
>
> On Wed, Nov 1, 2017 at 11:32 PM, Mahesh Jethanandani 
> <[email-masked] <mailto:[email-masked]>> wrote:
>
>     Ranga,
>
>     Is there a reason why you do not want to consider augmenting the
>     model, particularly since you seem to want to use the entire model?
>
>
>
> Yes. I want to include other metadata (specifically MUD + other 
> management data modeled using YANG) associated with the ACL in a 
> container in my own model. For this I want to import access-lists from 
> the ACL YANG model but as it currently stands, I can't.
>
> With the way it has been defined (i.e. as a container and not a 
> grouping), I cannot include it in another YANG model. It would be 
> perfect if the access-lists could be made into a grouping as 
> suggested. Nothing else needs to change as far as I am concerned.
>
> Thanks!
>
> Regards,
>
> Ranga.
>
>
>
>
>
>     > On Oct 31, 2017, at 8:39 PM, M. Ranganathan <[email-masked]
>     <mailto:[email-masked]>> wrote:
>     >
>     > The use-case for this change request - I would like to use the
>     grouping in another YANG model using a "uses" statement.
>     >
>     > [email-masked] <mailto:[email-masked]>
>     <https://www.ietf.org/mailman/listinfo/netmod>
>
>     Mahesh Jethanandani
>     [email-masked] <mailto:[email-masked]>
>
>
>
>
> -- 
> M. Ranganathan
>
>

---

From: "M. Ranganathan" <[email-masked]>
Date: Thu, 2 Nov 2017 11:34:36 -0400

Hi Rob, Mahesh,

Thanks for reading.

On Thu, Nov 2, 2017 at 11:00 AM, Robert Wilton <[email-masked]> wrote:

> Hi Ranga,
>
> Presumably another choice would to keep ACLs defined in one place (i.e. no
> grouping required), augment with ACL model with your extra MUD + other mgmt
> data, and then have a reference to that ACL from your model.
>
> Thanks,
> Rob
>

 In the case of MUD ( which is just a use case driving this need ), there
are local references from MUD to the ACL. MUD itself augments the ACL
model.

Augmentation would make (logical and design) sense if you were adding nodes
that are in some way related to the ACL itself.

If I wanted to Augment ACL with something that is not directly ACL relevant
then Augmentation makes less sense to me from a design perspective (lets
say I wanted to define a new YANG model that includes the ACL with some
other system-relavant meta-data that has nothing to do with ACLs but is
needed by the system in order to install an ACL).

Making access-lists into a grouping and then using it in a container does
not alter the ACL model as it currently stands but allows designers to use
the ACL model with either augmentation or inclusion in other YANG models.
Hence it improves the usability of the ACL model without altering the
semantics of the current model. It is just a re-structuring but it helps
the implementer.

Regards,

Ranga

> netmod mailing [email-masked]://www.ietf.org/mailman/listinfo/netmod
>
>
>

-- 
M. Ranganathan

---

From: Andy Bierman <[email-masked]>
Date: Thu, 2 Nov 2017 08:55:50 -0700

On Thu, Nov 2, 2017 at 8:34 AM, M. Ranganathan <[email-masked]> wrote:

>> no grouping required), augment with ACL model with your extra MUD + other
>> mgmt data, and then have a reference to that ACL from your model.
>>
>> Thanks,
>> Rob
>>
>
> Augmentation would make (logical and design) sense if you were adding
> nodes that are in some way related to the ACL itself.
>
> If I wanted to Augment ACL with something that is not directly ACL
> relevant then Augmentation makes less sense to me from a design perspective
> (lets say I wanted to define a new YANG model that includes the ACL with
> some other system-relavant meta-data that has nothing to do with ACLs but
> is needed by the system in order to install an ACL).
>
Loosely coupled tables should use leafref.
The main concern of the NETMOD WG should be the usability of the primary
solution.

> Ranga

Andy

>> management data modeled using YANG) associated with the ACL in a container
>> in my own model. For this I want to import access-lists from the ACL YANG
>> model but as it currently stands, I can't.
>>
>> grouping), I cannot include it in another YANG model. It would be perfect
>> if the access-lists could be made into a grouping as suggested. Nothing
>> else needs to change as far as I am concerned.
>>
>> Thanks!
>>
>> Regards,
>>
>> Ranga.
>>
>>
>>
>>
>>
>>>

---

From: "M. Ranganathan" <[email-masked]>
Date: Thu, 2 Nov 2017 12:26:01 -0400

Hi Andy

> The main concern of the NETMOD WG should be the usability of the primary

Not sure I understand the suggestion of using a leafref (please excuse my
ignorance -- I am not a YANG expert by any stretch). If I used leafref,
what leaf would I be referring to if I wanted to point to the access
control list from another YANG model?

Also I note from the description of Access Control Lists the following that
would indicate that it is a primary solution that one may like to re-use in
another model.

 description
      "This is a top level container for Access Control Lists.
       It can have one or more Access Control Lists.";

If the requested change were made, would it result in excessive churn ?

Thanks

Regards,

Ranga.

-- 
M. Ranganathan

-- 
M. Ranganathan

---

From: Andy Bierman <[email-masked]>
Date: Thu, 2 Nov 2017 09:37:28 -0700

On Thu, Nov 2, 2017 at 9:26 AM, M. Ranganathan <[email-masked]> wrote:

>>>  In the case of MUD ( which is just a use case driving this need ),
>>> there are local references from MUD to the ACL. MUD itself augments the ACL
>>> model.
>>>
>>> Making access-lists into a grouping and then using it in a container
>>> does not alter the ACL model as it currently stands but allows designers to
>>> use the ACL model with either augmentation or inclusion in other YANG
>>> models. Hence it improves the usability of the ACL model without altering
>>> the semantics of the current model. It is just a re-structuring but it
>>> helps the implementer.
>>>
>>>

Augment is not the only way to couple data models.
You can have another list just define a foreign key (called a leafref in
YANG
since it does not have to reference a key)

>
> Also I note from the description of Access Control Lists the following
> that would indicate that it is a primary solution that one may like to
> re-use in another model.
>
>  description
I never understood why the WG wanted to change the ACL model
to its current form with containers.  Seems complicated to me.

Andy

---

From: "M. Ranganathan" <[email-masked]>
Date: Fri, 3 Nov 2017 13:03:11 -0400

Hello Mahesh,

On Thu, Nov 2, 2017 at 11:36 PM, Mahesh Jethanandani <
[email-masked]> wrote:

>
> On Nov 2, 2017, at 11:34 PM, M. Ranganathan <[email-masked]> wrote:
>
> Hi Rob, Mahesh,
>
> Thanks for reading.
>
> Can you give an example? Would you be for example using the match
> container(s) in the ACL draft, but not use the actions container?
>
>
>

I would need to be able to use all of the containers.

For example, I want to define a YANG model  and auto-generate code in
opendaylight that will accept a JSON structure such as the following

{
 "extension-info" : {
      "auxiliary-information" : "https://some.domain.com/foo";
     "ietf-access-control-list:access-lists": {

          "acl-name": "some-acl-name",
           "acl-type": "ipv4-acl",
           .....

       }

     }
}

Ideally, I don't want to modify the ACL model for this purpose.

Thanks,

Regards,

Ranga.

-- 
M. Ranganathan