Subject: [netmod] Netmod ACL - Can "access-lists" be set up as a "grouping"

From: "Jon Shallow" <[email-masked]>
Date: Mon, 8 Jan 2018 10:53:53 -0000

Hi There,

I appreciate that this is late to the table, but is it possible to set up
"access-lists" as a "grouping" in the YANG data model so that "access-lists"
can be included by "uses" in a higher level YANG data model?

I have raised this as issue #22 at
https://github.com/netmod-wg/acl-model/issues

Regards

Jon

---

From: "Einar Nilsen-Nygaard (einarnn)" <[email-masked]>
Date: Mon, 8 Jan 2018 15:02:53 +0000

Since this is a 7-line change, I see no harm in it if no-one objects? Mahesh has the token for rolling in updates discussed just prior to the end of 2017.

Here’s a possible diff:

$ git diff -b
diff --git a/src/yang/ietf-access-control-list.yang b/src/yang/ietf-access-control-list.yang
index 4d698c9..b1a173f 100644
--- a/src/yang/ietf-access-control-list.yang
+++ b/src/yang/ietf-access-control-list.yang
@@ -402,6 +402,10 @@ module ietf-access-control-list {
   /*
    * Configuration data nodes
    */
+  grouping access-lists-top {
+    description
+      "Grouping to allow reuse of access lists container elsewhere.";
+
     container access-lists {
       description
         "This is a top level container for Access Control Lists.
@@ -576,6 +580,9 @@ module ietf-access-control-list {
         }
       }
     }
+  }
+  uses access-lists-top;
+
   augment "/if:interfaces/if:interface" {
     description
       "Augment interfaces to allow ACLs to be associated in either the

Cheers,

Einar

On 8 Jan 2018, at 10:53, Jon Shallow <[email-masked]<mailto:[email-masked]>> wrote:

Hi There,

I appreciate that this is late to the table, but is it possible to set up “access-lists” as a “grouping” in the YANG data model so that “access-lists” can be included by “uses” in a higher level YANG data model?

I have raised this as issue #22 at https://github.com/netmod-wg/acl-model/issues

Regards

Jon
_______________________________________________
netmod mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/netmod

---

From: Robert Wilton <[email-masked]>
Date: Mon, 8 Jan 2018 15:31:26 +0000

Hi Einar, Jon, Mahesh,

My gut instinct is that making this a grouping might not be a good idea:

1) If somebody updates the core ACL model, will then need to check that 
anyone using it should be similarly updated (unless they use 
import-by-revision).

2) Does it make sense to define ACLs in separate places.  Would like be 
more simple if ACLs were defined in a central place and then just 
referenced by other protocols as required.

3) I think that groupings are probably overused and I think that they 
can detract from the readability of the model.  (I regard the OpenConfig 
YANG models as an extreme example of this, where it is necessary to 
compile the modules together to figure out where everything fits together).

Having said that, I don't think that this issue is important enough to 
have a long discussion about ...

Thanks,
Rob

On 08/01/2018 15:02, Einar Nilsen-Nygaard (einarnn) wrote:
> Since this is a 7-line change, I see no harm in it if no-one objects? 
> Mahesh has the token for rolling in updates discussed just prior to 
> the end of 2017.
>
> Here’s a possible diff:
>
> $ git diff -b
>> On 8 Jan 2018, at 10:53, Jon Shallow <[email-masked] 
>> <mailto:[email-masked]>> wrote:
>>
>> Hi There,
>> I appreciate that this is late to the table, but is it possible to 
>> set up “access-lists” as a “grouping” in the YANG data model so that 
>> “access-lists” can be included by “uses” in a higher level YANG data 
>> model?
>> I have raised this as issue #22 
>> athttps://github.com/netmod-wg/acl-model/issues
>> Regards
>> Jon
>> [email-masked] <mailto:[email-masked]>
> [email-masked]

---

From: Martin Bjorklund <[email-masked]>
Date: Mon, 08 Jan 2018 16:45:09 +0100 (CET)

Hi,

Robert Wilton <[email-masked]> wrote:
> 1) If somebody updates the core ACL model, will then need to check
> that anyone using it should be similarly updated (unless they use
> import-by-revision).
> 
> 2) Does it make sense to define ACLs in separate places.  Would like
> be more simple if ACLs were defined in a central place and then just
> can detract from the readability of the model.  (I regard the
> OpenConfig YANG models as an extreme example of this, where it is
> necessary to compile the modules together to figure out where
> everything fits together).

I agree with all three statements.  The current acl data model has a
top-level grouping "interface-acl" which probably is not intended to
be "exported".  I think ot should be moved into the
"attachment-points" container, in order to make it local.

If the entire access-list container is defined as a goruping, and is
used in multiple places, how are the multiple interface
attachment-points handled?

/martin

> >> I appreciate that this is late to the table, but is it possible to set
> >> up “access-lists” as a “grouping” in the YANG data model so that

---

From: "Jon Shallow" <[email-masked]>
Date: Mon, 8 Jan 2018 15:47:11 -0000

Hi Robert,

A good set of points.

My particular use case (hence raising the question) is defining a YANG model where there are multiple appliances and where ACLs are defined for each appliance, but there is the likelihood of the different appliances using the same “acl-name”, but the contents of “acl-name” are different.  Having a grouping (using import-by-revision) would help me considerably here.

Regards

Jon

From: Robert Wilton [mailto: [email-masked]] 
Sent: 08 January 2018 15:31
To: Einar Nilsen-Nygaard (einarnn); Jon Shallow; Mahesh Jethanandani
Cc: [email-masked]
Subject: Re: [netmod] Netmod ACL - Can "access-lists" be set up as a "grouping"

Hi Einar, Jon, Mahesh,

1) If somebody updates the core ACL model, will then need to check that anyone using it should be similarly updated (unless they use import-by-revision).

2) Does it make sense to define ACLs in separate places.  Would like be more simple if ACLs were defined in a central place and then just referenced by other protocols as required.

3) I think that groupings are probably overused and I think that they can detract from the readability of the model.  (I regard the OpenConfig YANG models as an extreme example of this, where it is necessary to compile the modules together to figure out where everything fits together).

Having said that, I don't think that this issue is important enough to have a long discussion about ...

Thanks,
Rob

Here’s a possible diff: 

$ git diff -b

   /*

    */

+    description

+

     container access-lists {

       description

         }

       }

     }

+  }

+  uses access-lists-top;

+

     description

Cheers,

Einar

On 8 Jan 2018, at 10:53, Jon Shallow <[email-masked]> wrote:

Hi There,

I have raised this as issue #22 at  <https://github.com/netmod-wg/acl-model/issues> https://github.com/netmod-wg/acl-model/issues

Regards

Jon

_______________________________________________
netmod mailing list
 <mailto:[email-masked]> [email-masked]
 <https://www.ietf.org/mailman/listinfo/netmod> https://www.ietf.org/mailman/listinfo/netmod

---

From: "Einar Nilsen-Nygaard (einarnn)" <[email-masked]>
Date: Mon, 8 Jan 2018 15:51:56 +0000

On 8 Jan 2018, at 15:31, Robert Wilton -X (rwilton - ENSOFT LIMITED at Cisco) <[email-masked]<mailto:[email-masked]>> wrote:

Hi Einar, Jon, Mahesh,

Groupings and typedefs are subject to the same backwards-compatibility constraints as any other data. Thus updates to the model should always be trouble-free if the updates conform to RFC 6020/7950 backwards-compatibility rules for model updates.

Jon clearly has a case he is thinking about, and making an access list container reusable doesn’t seem like an intrinsically bad idea to me. What may be an irritating thing is if there are >1 use case for this and each use case is in effect required to define it’s own idea of a list of access list definitions.

I’m not going to disagree with your comments on the overuse of groupings. We could also refer to Cisco IOS-XR native models, where we have some models with 8 levels (perhaps more?) of nested groupings ;-)

Likewise. I have no objection to this change, but no strong vested interest either. What I’m most interested in is getting to an agreed model at this point, and this change wouldn’t impact that as it doesn’t change the actual model.

Jon — could you perhaps articulate your use case(s)? And perhaps update https://github.com/netmod-wg/acl-model/issues with them?

Cheers,

Einar

Thanks,
Rob

Here’s a possible diff:

$ git diff -b

Cheers,

Einar

Hi There,

Regards

Jon

---

From: "Acee Lindem (acee)" <[email-masked]>
Date: Mon, 8 Jan 2018 15:59:45 +0000

Hi Jon,

From: netmod <[email-masked]<mailto:[email-masked]>> on behalf of Jon Shallow <[email-masked]<mailto:[email-masked]>>
Date: Monday, January 8, 2018 at 10:47 AM
To: "Robert Wilton -X (rwilton - ENSOFT LIMITED at Cisco)" <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, "Einar Nilsen-Nygaard (einarnn)" <[email-masked]<mailto:[email-masked]>>, 'Mahesh Jethanandani' <[email-masked]<mailto:[email-masked]>>
Subject: Re: [netmod] Netmod ACL - Can "access-lists" be set up as a "grouping"

Hi Robert,

A good set of points.

I guess I don’t see the use case. Wouldn’t you have multiple network devices for multiple network devices? Or at least separate LNEs?  https://www.ietf.org/id/draft-ietf-rtgwg-lne-model-05.txt

Thanks,
Acee

Regards

Jon

From: Robert Wilton [mailto: [email-masked]<mailto:[email-masked]>]
Sent: 08 January 2018 15:31
To: Einar Nilsen-Nygaard (einarnn); Jon Shallow; Mahesh Jethanandani
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [netmod] Netmod ACL - Can "access-lists" be set up as a "grouping"

Hi Einar, Jon, Mahesh,

Thanks,
Rob

Here’s a possible diff:

$ git diff -b

Cheers,

Einar

Hi There,

Regards

Jon

netmod mailing list

---

From: Martin Bjorklund <[email-masked]>
Date: Mon, 08 Jan 2018 17:46:21 +0100 (CET)

"Acee Lindem (acee)" <[email-masked]> wrote:
> Hi Jon,
> 
> From: netmod <[email-masked]<mailto:[email-masked]>>
> on behalf of Jon Shallow
> <[email-masked]<mailto:[email-masked]>>
> To: "Robert Wilton -X (rwilton - ENSOFT LIMITED at Cisco)"
> <[email-masked]<mailto:[email-masked]>>,
> "[email-masked]<mailto:[email-masked]>"
> <[email-masked]<mailto:[email-masked]>>, "Einar Nilsen-Nygaard
> (einarnn)" <[email-masked]<mailto:[email-masked]>>, 'Mahesh
> Jethanandani'
> <[email-masked]<mailto:[email-masked]>>
> My particular use case (hence raising the question) is defining a YANG
> model where there are multiple appliances and where ACLs are defined
> for each appliance, but there is the likelihood of the different
> appliances using the same “acl-name”, but the contents of “acl-name”
> are different.  Having a grouping (using import-by-revision) would
> help me considerably here.
> 
> I guess I don’t see the use case. Wouldn’t you have multiple network
> devices for multiple network devices? Or at least separate LNEs?
> https://www.ietf.org/id/draft-ietf-rtgwg-lne-model-05.txt

Right.  If a grouping is required for acls for this use case, wouldn't
the same be true for interfaces and the other models?  I think LNE or
schema mount in general solves this issue.

/martin

> 
> Thanks,
> Acee
> 
> Regards
> 
> Jon
> 
> From: Robert Wilton [mailto:
> [email-masked]<mailto:[email-masked]>]
> On 8 Jan 2018, at 10:53, Jon Shallow
> <[email-masked]<mailto:[email-masked]>> wrote:
> 
> Hi There,
>

---

From: Mahesh Jethanandani <[email-masked]>
Date: Tue, 9 Jan 2018 16:41:17 -0800

Hi,

> On Jan 8, 2018, at 7:45 AM, Martin Bjorklund <[email-masked]> wrote:
> 
> Hi,
> 

Have moved “interface-acl” under the “attachment-point” container and made it local.

Thanks.

>>>> athttps://github.com/netmod-wg/acl-model/issues

Mahesh Jethanandani
[email-masked]