Subject: [netmod] Suresh Krishnan's Discuss on draft-ietf-netmod-acl-model-19: (with DISCUSS)

From: Suresh Krishnan <[email-masked]>
Date: Wed, 26 Sep 2018 21:36:51 -0700

Suresh Krishnan has entered the following ballot position for
draft-ietf-netmod-acl-model-19: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-netmod-acl-model/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

This document is missing ACL handling for ICMPv6 (RFC4443) completely. As the
ICMP types and codes are different for ICMP and ICMPv6 I think this model
should be included to cover ICMPv6.

---

From: Mahesh Jethanandani <[email-masked]>
Date: Wed, 26 Sep 2018 21:57:21 -0700

Hi Suresh,

> On Sep 26, 2018, at 9:36 PM, Suresh Krishnan <[email-masked]> wrote:
> 

I understand that there are many protocols that fall into such a criteria. As has already been discussed, we are offering the minimum set of protocols for which there is a demand, while giving the option to extend it through augmentations of the base model.

Let us not boil the ocean. As it is, this draft has been in the works for more than 4 years.

---

From: Suresh Krishnan <[email-masked]>
Date: Thu, 27 Sep 2018 05:06:51 +0000

Hi Mahesh,
  Thanks for your quick reply. Please find comments inline.

> On Sep 27, 2018, at 12:57 AM, Mahesh Jethanandani <[email-masked]> wrote:
> 
> Hi Suresh,
> 

I understand where you are coming from but ICMPv6 is not just another protocol. It is a core protocol in the IPv6 protocol suite. Do you know of any systems that support IPv6 acls but not support ICMPv6 there?

> Let us not boil the ocean. As it is, this draft has been in the works for more than 4 years.

This is a very clear and bounded request (i.e. not boiling the ocean). I do not think this will be significant amount of work. If you do feel otherwise, I will be glad to revisit my position

Regards
Suresh

---

From: Mahesh Jethanandani <[email-masked]>
Date: Wed, 26 Sep 2018 23:43:10 -0700

Hi Suresh,

Is the model usable as is? Can it be augmented for other protocols? 

I think the answer to both the questions is yes. I do not see why then can requests like yours not be handled as separate drafts. What is the reason to hold up this draft this late in the game?

Cheers.

> On Sep 26, 2018, at 10:06 PM, Suresh Krishnan <[email-masked]> wrote:
> 
> Hi Mahesh,

---

From: Mahesh Jethanandani <[email-masked]>
Date: Thu, 27 Sep 2018 15:36:32 -0700

> https://datatracker.ietf.org/doc/draft-ietf-netmod-acl-model/

In offline discussions with Suresh, here is what we agreed I would do to address this DISCUSS:

- Update the rest-of-header field in ICMP grouping from ‘type uint32’ to ‘type binary’, as already agreed, to address Mirja’s DISCUSS. The field will be unbounded.
- Add a reference to RFC 4443 in the grouping.
- At this point the grouping should be able to cater to both icmpv4 and icmpv6 match requirements.

Thanks

Mahesh Jethanandani
[email-masked]

---

From: Suresh Krishnan <[email-masked]>
Date: Fri, 28 Sep 2018 14:04:10 +0000

> On Sep 27, 2018, at 6:36 PM, Mahesh Jethanandani <[email-masked]> wrote:
> 
> 
> 

Yep. That would handle the issue perfectly well. I will clear as soon as the next rev hits.

Thanks
Suresh