Subject: [netmod] Access Control List Ordering

From: "Acee Lindem (acee)" <[email-masked]>
Date: Tue, 24 Mar 2015 19:54:22 +0000

The point that I didn’t want to belabor in today’s meeting was that fact that the order of application of ACEs needs to be specified. I can appreciate the fact that ccess-control-list-name is simply a handle to reference a given ACE, e.g. “Allow-AS-1135”. However, since a given ACE entry matches on multiple  packet fields, saying you just “match on the most specific ACE” doesn’t make sense unless standardize precisely what constitutes the most specific match. Furthermore, I don’t think it should be called an access-list model unless it retains the semantics of matching in a user controlled order (i.e., a sequence).

Thanks,
Acee

From: <Sterne>, "Jason (Jason)" <[email-masked]<mailto:[email-masked]>>
Date: Tuesday, March 24, 2015 at 9:54 AM
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: [netmod] full access-control-list name vs acl abbreviation in yang model

In the NETMOD session today there was a proposal to deal with the full “access-control-list” names for lists & other objects vs “acl”.

How about use the full “access-control-list” at the top container (as was shown Dean’s slides) but then use “acl” everywhere inside ?  i.e. instead of “ace” how about “acl-entry” ?   Once we abbreviate access-control-list to “acl” then we can probably leave other words as full words:

  *   acl-name
  *   acl-type
  *   acl-entry
  *   etc

Jason

---

From: Martin Bjorklund <[email-masked]>
Date: Tue, 24 Mar 2015 15:52:52 -0500 (CDT)

"Acee Lindem (acee)" <[email-masked]> wrote:
> The point that I didn’t want to belabor in today’s meeting was that
> fact that the order of application of ACEs needs to be specified.

Absolutely!

And that is exactly what an ordered-by user list does.  The user
(operator) controls the order of the list instances.

/martin

> I
> can appreciate the fact that ccess-control-list-name is simply a
> handle to reference a given ACE, e.g. “Allow-AS-1135”. However, since
> a given ACE entry matches on multiple packet fields, saying you just
> “match on the most specific ACE” doesn’t make sense unless standardize
> precisely what constitutes the most specific match. Furthermore, I
> don’t think it should be called an access-list model unless it retains
> the semantics of matching in a user controlled order (i.e., a
> sequence).
> 
> Thanks,
> Acee
> 
> From: <Sterne>, "Jason (Jason)"
> <[email-masked]<mailto:[email-masked]>>
> To: "[email-masked]<mailto:[email-masked]>"
> <[email-masked]<mailto:[email-masked]>>
> In the NETMOD session today there was a proposal to deal with the full
> “access-control-list” names for lists & other objects vs “acl”.
> 
> How about use the full “access-control-list” at the top container (as
> was shown Dean’s slides) but then use “acl” everywhere inside ?
> i.e. instead of “ace” how about “acl-entry” ?  Once we abbreviate
> access-control-list to “acl” then we can probably leave other words as
> full words:
> 
>   *   acl-name
>   *   acl-type
>   *   acl-entry
>   *   etc
> 
> 
> Jason
>

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Tue, 24 Mar 2015 21:59:24 +0100

Acee,

can you please check the document? It says in several places that this
is an ordered list. It will help to work on the document and to find
out what is in the document is unclear.

/js

> _______________________________________________
> netmod mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netmod

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1 | 28759 Bremen | Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

---

From: "Acee Lindem (acee)" <[email-masked]>
Date: Tue, 24 Mar 2015 21:16:02 +0000

Jurgen,
The part I’m missing is how the user orders the list if there isn’t
anything in the ACE to indicate give a hint as to the order. For example,
if a user wants to add ACE “disallow-telnet” in the middle of the list,
how is this accomplished without resending the whole ACL (or at least up
until the new entry) to the NETCONF device?

Thanks,
Acee 

On 3/24/15, 3:59 PM, "Juergen Schoenwaelder"
<[email-masked]> wrote:

>>fact that the order of application of ACEs needs to be specified. I can
>>appreciate the fact that ccess-control-list-name is simply a handle to
>>reference a given ACE, e.g. “Allow-AS-1135”. However, since a given ACE
>>entry matches on multiple  packet fields, saying you just “match on the
>>most specific ACE” doesn’t make sense unless standardize precisely what
>>constitutes the most specific match. Furthermore, I don’t think it
>>should be called an access-list model unless it retains the semantics of
>>matching in a user controlled order (i.e., a sequence).
>> 
>> Thanks,
>> Acee
>> 
>>was shown Dean’s slides) but then use “acl” everywhere inside ?  i.e.
>>instead of “ace” how about “acl-entry” ?   Once we abbreviate

---

From: Andy Bierman <[email-masked]>
Date: Tue, 24 Mar 2015 16:20:57 -0500

> until the new entry) to the NETCONF device?

The XML document order of the data from the client specifies the
ACE order.   See RFC 6020, sec. 7.7.1 and 7.7.5

> Acee

Andy

---

From: "Reshad Rahman (rrahman)" <[email-masked]>
Date: Tue, 24 Mar 2015 21:27:32 +0000

Does the insert attribute only for NETCONF or for RESTCONF also?

On 2015-03-24, 4:20 PM, "Andy Bierman" <[email-masked]> wrote:

>> The part I¹m missing is how the user orders the list if there isn¹t
>> if a user wants to add ACE ³disallow-telnet² in the middle of the list,
>>>> The point that I didn¹t want to belabor in today¹s meeting was that
>>>>reference a given ACE, e.g. ³Allow-AS-1135². However, since a given ACE
>>>>entry matches on multiple  packet fields, saying you just ³match on the
>>>>most specific ACE² doesn¹t make sense unless standardize precisely what
>>>>constitutes the most specific match. Furthermore, I don¹t think it
>>>><[email-masked]<mailto:[email-masked]
>>>>>>
>>>>³access-control-list² names for lists & other objects vs ³acl².
>>>>
>>>> How about use the full ³access-control-list² at the top container (as
>>>>was shown Dean¹s slides) but then use ³acl² everywhere inside ?  i.e.
>>>>instead of ³ace² how about ³acl-entry² ?   Once we abbreviate
>>>>access-control-list to ³acl² then we can probably leave other words as
>>>>full words:
>>>>
>>>>   *   acl-name
>>>>   *   acl-type
>>>>   *   acl-entry
>>>>   *   etc
>>>>
>>>>
>>>> Jason
>>>>
>>>

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Tue, 24 Mar 2015 22:28:41 +0100

Acee,

for NETCONF, the details how this can be achieved can be found in RFC
6020 section 7.7.7.

/js

---

From: "Acee Lindem (acee)" <[email-masked]>
Date: Tue, 24 Mar 2015 21:40:38 +0000

Juergen,

The semantics certainly aren’t described very well as you need to infer
them from the example:

               <ssh>
                 <cipher nc:operation="create"
                         yang:insert="after"
                         yang:value="3des-cbc">blowfish-cbc</cipher>
               </ssh>

Are these described in another document? I didn’t find them with a search
of RFC 6241. 

Acee 

On 3/24/15, 4:28 PM, "Juergen Schoenwaelder"
<[email-masked]> wrote:

>> >> Subject: [netmod] full access-control-list name vs acl abbreviation
>>in
>> >>yang model
>> >>

---

From: "Sterne, Jason (Jason)" <[email-masked]>
Date: Tue, 24 Mar 2015 21:50:49 +0000

Hi guys,

I think there was some confusion in the meeting with statements about matching a "more specific ACE".  I'm fairly certain that most (all) vendors agree that ACLs are an ordered list and the node tries to match against each acl-entry in order until it finds a match and then stops there.  

NETCONF can manage ordered lists without a sequence number.  Sections 7.7.1 and 7.7.5 are actually for leaf-lists but there are similar sections for lists.   Here is an example from the RFC of adding something to the middle of a list:
                   yang:insert="after"
                   yang:key="[ex:name='fred']">

I do like the ability to arbitrarily insert an entry anywhere in an ACL without having to leave space in between acl entries but on the other hand I'm not a fan of using the implicit order that acl-entries arrive in at the server to determine the order. When the order is more explicit from the key (e.g. using a number instead of a string) it is easier to understand & use. Using sequence numbering as a key means you sometimes run out of space between two entries but operators are pretty used to managing that (leaving spaces in the numbering, etc).  An RPC could be used to add renumbering type operations to free up space.

Maybe it isn’t a priority for some systems but I also wonder how SNMP would represent ordered acl-entries if there isn't a sequence number that can be used as (at least part of) the key.

Regards,
Jason

-----Original Message-----
From: netmod [mailto:[email-masked]] On Behalf Of Andy Bierman
Sent: Tuesday, March 24, 2015 4:21 PM
To: Acee Lindem (acee)
Cc: [email-masked]
Subject: Re: [netmod] Access Control List Ordering

On Tue, Mar 24, 2015 at 4:16 PM, Acee Lindem (acee) <[email-masked]> wrote:
> anything in the ACE to indicate give a hint as to the order. For 
> example, if a user wants to add ACE “disallow-telnet” in the middle of 
> the list, how is this accomplished without resending the whole ACL (or 
> at least up until the new entry) to the NETCONF device?
>

Andy

>>>fact that the order of application of ACEs needs to be specified. I 
>>>“match on the most specific ACE” doesn’t make sense unless 
>>>standardize precisely what constitutes the most specific match. 
>>>Furthermore, I don’t think it should be called an access-list model 
>>>unless it retains the semantics of matching in a user controlled order (i.e., a sequence).
>>>
>>> Thanks,
>>> Acee
>>>
>>>in yang model
>>> In the NETMOD session today there was a proposal to deal with the 
>>>full “access-control-list” names for lists & other objects vs “acl”.
>>>
>>> How about use the full “access-control-list” at the top container 
>>>(as was shown Dean’s slides) but then use “acl” everywhere inside ?  i.e.
>>>access-control-list to “acl” then we can probably leave other words 
>>>as full words:
>>>
>>>   *   acl-name
>>>   *   acl-type
>>>   *   acl-entry
>>>   *   etc
>>>
>>>
>>> Jason
>>>
>>

---

From: Andy Bierman <[email-masked]>
Date: Tue, 24 Mar 2015 16:58:26 -0500

> Maybe it isn’t a priority for some systems but I also wonder how SNMP would represent ordered acl-entries if there isn't a sequence number that can be used as (at least part of) the key.

User-ordered lists are YANG-specific.
I advice against using them if you want multiple protocols
like SNMP and CLI to work with the data.

Andy

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Tue, 24 Mar 2015 23:05:19 +0100

The relevant text is in RFC 6020 section 7.7.7. (The reason for this
is history; ordered-by-user came along with YANG after NETCONF was
done.) The text may not be perfect but there surely is more than an
example:

   The "insert" attribute can take the values "first", "last", "before",
   and "after".  If the value is "before" or "after", the "value"
   attribute MUST also be used to specify an existing entry in the leaf-
   list.

And there is more text around this. Perhaps we need to improve things
but for sure there is more than an example.

Anyway, bottom line is that NETCONF and insert and delete in an
ordered-by-user list.

/js

On Tue, Mar 24, 2015 at 09:40:38PM +0000, Acee Lindem (acee) wrote:
> >>example,
> >>can
> >>full