Subject: [Dots] Data Channel ACL Actions

From: "Jon Shallow" <[email-masked]>
Date: Fri, 17 Nov 2017 17:50:46 -0000

Hi there,

draft-ietf-netmod-acl-model-14 has another significant change which affects
DOTS.

draft-ietf-netmod-acl-model-13 has the following for ACL actions

   +--rw actions                        

   |  +--rw (packet-handling)?                  

   |  |  +--:(deny)              

   |  |  |  +--rw deny?      empty                      

   |  |  +--:(permit)                   

   |  |     +--rw permit?    empty                      

   |  +--rw logging?   Boolean

draft-ietf-netmod-acl-model-14 has updated it with this

   +--rw actions

   |       {acl-aggregate-stats or interface-acl-aggregate }?

   |  +--rw forwarding    identityref   

   |  +--rw logging?      identityref   

   |  +--rw icmp-off?     Boolean

With different definitions for forwarding.

So, I reckon that Figure 8 should look like

  POST /restconf/data/ietf-dots-access-control-list HTTP/1.1

  Host: www.example.com

  Content-Format: "application/yang.api+json"

  {

   "ietf-dots-access-control-list:access-lists": {

      "client-identifier": [

       "dz6pHjaADkaFTbjr0JGBpw",

       "iAYmCNPmrYoKoqzgFMiobw"

      ],

      "acl": [

          {

               "acl-name": "sample-ipv4-acl",

               "acl-type": "ipv4-acl",

               "aces": {

                   "ace": [

                       {

                           "rule-name": "rule1",

                           "matches": {

                             "ipv4-acl": {

                               "source-ipv4-network": "192.0.2.0/24",

                               "destination-ipv4-network": "198.51.100.0/24"

                             }

                            },

                            "actions": {

                                "forwarding" : "drop"

                            }

                        }

                    ]

               }

          }

      ]

   }

  }

                 Figure 8: POST to install filtering rules

With a fair amount of permit = allow, deny = drop (or should it be reject -
I do not think so) and augment updates through the document.

Regards

Jon

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Wed, 22 Nov 2017 06:26:15 +0000

Hi Jon,

I don't think the new actions container in draft-ietf-netmod-acl-model-14 can be augmented to add a new rate-limit action, I can augment to add a new dots specific action container. The updated yang model looks as follows (it will also order the ACLs created by a DOTS client):

module: ietf-dots-access-control-list
  augment /ietf-acl:access-lists:
    +--rw client-identifier*   binary
  augment /ietf-acl:access-lists/ietf-acl:acl/ietf-acl:aces:
    +--rw dots-actions
       +--rw (packet-handling)?
          +--:(deny)
          |  +--rw deny?         empty
          +--:(permit)
          |  +--rw permit?       empty
          +--:(rate-limit)
             +--rw rate-limit?   decimal64
  augment /ietf-acl:access-lists/ietf-acl:acl/ietf-acl:aces/ietf-acl:ace:
    +--rw fragments?   empty
  augment /ietf-acl:access-lists:
    +--rw dots-acl-order
       +--rw acl-set* [set-name type]
          +--rw set-name    -> /ietf-acl:access-lists/acl/acl-name
          +--rw type        -> /ietf-acl:access-lists/acl/acl-type

-Tiru

From: Dots [mailto:[email-masked]] On Behalf Of Jon Shallow
Sent: Friday, November 17, 2017 11:21 PM
To: [email-masked]
Subject: [Dots] Data Channel ACL Actions

Hi there,

draft-ietf-netmod-acl-model-14 has another significant change which affects DOTS.

   +--rw actions

   +--rw actions

  Host: www.example.com<http://www.example.com>

With a fair amount of permit = allow, deny = drop (or should it be reject - I do not think so) and augment updates through the document.

Regards

Jon

---

From: "Roland Dobbins" <[email-masked]>
Date: Wed, 22 Nov 2017 14:09:42 +0700

On 22 Nov 2017, at 13:26, Konda, Tirumaleswar Reddy wrote:

> I don't think the new actions container in 
> draft-ietf-netmod-acl-model-14 can be augmented to add a new 
> rate-limit action,

Out of curiosity, why do we seem intent on replicating flowspec 
functionality in DOTS?

-----------------------------------
Roland Dobbins <[email-masked]>

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Wed, 22 Nov 2017 07:21:47 +0000

> -----Original Message-----
> From: Dots [mailto:[email-masked]] On Behalf Of Roland Dobbins
> Sent: Wednesday, November 22, 2017 12:40 PM
> To: [email-masked]
> Subject: Re: [Dots] Data Channel ACL Actions
> 
> Out of curiosity, why do we seem intent on replicating flowspec functionality
> in DOTS?

The intent is not to replicate flowspec functionality, rate-limiting is discussed in both the architecture and requirements drafts, and 
the WG wanted the rate-limit action in addition to permit and deny actions.

-Tiru

> _______________________________________________
> Dots mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dots

---

From: "Jon Shallow" <[email-masked]>
Date: Wed, 22 Nov 2017 15:59:35 -0000

Hi Tiru,

I agree that the new actions container with forwarding identityref is not
workable for adding in rate-limiting.  Forwarding is a mandatory field, so
another possibility is that you augment actions (the level above) with
rate-limiting.  This then gives the possibility of allow with a rate-limit
or drop with a rate-limit - a bit messy though.

I think

    +--rw fragments?   empty

Should (at a minimum) read (as netmod-14 has added in another layer)

  augment
/ietf-acl:access-lists/ietf-acl:acl/ietf-acl:aces/ietf-acl:ace/ietf-acl:ipv4
-acl:

    +--rw fragments?   empty

  augment
/ietf-acl:access-lists/ietf-acl:acl/ietf-acl:aces/ietf-acl:ace/ietf-acl:ipv6
-acl:

    +--rw fragments?   empty

In Figure 8, you have (ignoring the fact that "actions" should now be
"dots-actions" if your change is accepted)

"deny": [null]

Which is an empty array.  I think it should be

"deny": null

Regards

Jon

From: Dots [mailto: [email-masked]] On Behalf Of Konda, Tirumaleswar
Reddy
Sent: 22 November 2017 06:26
To: Jon Shallow; [email-masked]
Subject: Re: [Dots] Data Channel ACL Actions

Hi Jon,

I don't think the new actions container in draft-ietf-netmod-acl-model-14
can be augmented to add a new rate-limit action, I can augment to add a new
dots specific action container. The updated yang model looks as follows (it
will also order the ACLs created by a DOTS client):

    +--rw dots-actions

       +--rw (packet-handling)?

          +--:(deny)

          |  +--rw deny?         empty

          +--:(permit)

          |  +--rw permit?       empty

          +--:(rate-limit)

    +--rw fragments?   empty

    +--rw dots-acl-order

 

-Tiru

Hi there,

 

   +--rw actions                        

   |  |  +--:(deny)              

   |  |  |  +--rw deny?      empty                      

   |  |  +--:(permit)                   

   |  |     +--rw permit?    empty                      

   |  +--rw logging?   Boolean

   +--rw actions

  Host:  <http://www.example.com> www.example.com

  {

      "client-identifier": [

       "iAYmCNPmrYoKoqzgFMiobw"

      ],

      "acl": [

          {

               "acl-type": "ipv4-acl",

               "aces": {

                   "ace": [

                       {

                           "rule-name": "rule1",

                           "matches": {

                             "ipv4-acl": {

                             }

                            },

                            "actions": {

                                "forwarding" : "drop"

                            }

                        }

                    ]

               }

          }

      ]

   }

  }

Regards

Jon

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Thu, 23 Nov 2017 08:24:44 +0000

Hi Jon,

Good point, rate-limit makes sense only with allow action (I have the updated the yang model to use "when-stmt" to make rate-limit leaf node valid only when "accept" action is used)

    augment "/ietf-acl:access-lists/ietf-acl:acl/ietf-acl:aces" +
            "/ietf-acl:ace/ietf-acl:actions" {
        description "rate-limit action";
        leaf rate-limit {
           when "/ietf-acl:access-lists/ietf-acl:acl/ietf-acl:aces/ietf-acl:ace" +
                "/ietf-acl:actions/ietf-acl:forwarding != 'accept'" {
              description "rate-limit valid only when accept action is used";
           }
           type decimal64 {
             fraction-digits 2;
           }
           description "rate-limit traffic";
       }
    }

Also updated draft to address your other comment related to fragments
  augment /ietf-acl:access-lists/ietf-acl:acl/ietf-acl:aces/ietf-acl:ace/ietf-acl:matches/ietf-acl:ipv4-acl:
    +--rw fragments?   empty
  augment /ietf-acl:access-lists/ietf-acl:acl/ietf-acl:aces/ietf-acl:ace/ietf-acl:matches/ietf-acl:ipv6-acl:
    +--rw fragments?   empty

The updated draft is uploaded to https://github.com/dotswg/dots-data-channel/blob/master/draft-ietf-dots-data-channel-08.txt

Cheers,
-Tiru

From: Dots [mailto:[email-masked]] On Behalf Of Jon Shallow
Sent: Wednesday, November 22, 2017 9:30 PM
To: Konda, Tirumaleswar Reddy <[email-masked]>; [email-masked]
Subject: Re: [Dots] Data Channel ACL Actions

Hi Tiru,

I agree that the new actions container with forwarding identityref is not workable for adding in rate-limiting.  Forwarding is a mandatory field, so another possibility is that you augment actions (the level above) with rate-limiting.  This then gives the possibility of allow with a rate-limit or drop with a rate-limit - a bit messy though.

I think

  augment /ietf-acl:access-lists/ietf-acl:acl/ietf-acl:aces/ietf-acl:ace/ietf-acl:ipv4-acl:
    +--rw fragments?   empty
  augment /ietf-acl:access-lists/ietf-acl:acl/ietf-acl:aces/ietf-acl:ace/ietf-acl:ipv6-acl:
    +--rw fragments?   empty

In Figure 8, you have (ignoring the fact that "actions" should now be "dots-actions" if your change is accepted)
"deny": [null]
Which is an empty array.  I think it should be
"deny": null

Regards

Jon

From: Dots [mailto: [email-masked]<mailto:[email-masked]>] On Behalf Of Konda, Tirumaleswar Reddy
Sent: 22 November 2017 06:26
To: Jon Shallow; [email-masked]<mailto:[email-masked]>
Subject: Re: [Dots] Data Channel ACL Actions

Hi Jon,

-Tiru

From: Dots [mailto:[email-masked]] On Behalf Of Jon Shallow
Sent: Friday, November 17, 2017 11:21 PM
To: [email-masked]<mailto:[email-masked]>
Subject: [Dots] Data Channel ACL Actions

Hi there,

   +--rw actions

   +--rw actions

Regards

Jon

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Thu, 23 Nov 2017 13:30:11 +0000

From: Konda, Tirumaleswar Reddy
Sent: Thursday, November 23, 2017 1:55 PM
To: 'Jon Shallow' <[email-masked]>; [email-masked]
Subject: RE: [Dots] Data Channel ACL Actions

Hi Jon,

Realized the condition can be simplified, used (when "ietf-acl:forwarding = 'accept'") instead

-Tiru

Cheers,
-Tiru

Hi Tiru,

I think

Regards

Jon

Hi Jon,

-Tiru

Hi there,

   +--rw actions

   +--rw actions

Regards

Jon

---

From: "Jon Shallow" <[email-masked]>
Date: Thu, 23 Nov 2017 13:58:59 -0000

Hi Tiru,

I think the rate limiting needs to be defined as being in bytes per second
or in bits per second for clarity.

I am a bit confused about your update - it is not the same as in
draft-ietf-dots-data-channel-08.txt.

Also, should rate-limit only be there when :forwarding = 'accept', rather
than a description telling you it is not there in the case of != 'accept'?

Regards

Jon

From: Dots [mailto: [email-masked]] On Behalf Of Konda, Tirumaleswar
Reddy
Sent: 23 November 2017 13:30
To: Jon Shallow; [email-masked]
Subject: Re: [Dots] Data Channel ACL Actions

Hi Jon,

Good point, rate-limit makes sense only with allow action (I have the
updated the yang model to use "when-stmt" to make rate-limit leaf node valid
only when "accept" action is used)

        leaf rate-limit {

           when
"/ietf-acl:access-lists/ietf-acl:acl/ietf-acl:aces/ietf-acl:ace" +

Realized the condition can be simplified, used (when "ietf-acl:forwarding =
'accept'") instead

-Tiru

              description "rate-limit valid only when accept action is
used";

           }

           type decimal64 {

             fraction-digits 2;

           }

       }

    }

  augment
/ietf-acl:access-lists/ietf-acl:acl/ietf-acl:aces/ietf-acl:ace/ietf-acl:matc
hes/ietf-acl:ipv4-acl:

    +--rw fragments?   empty

  augment
/ietf-acl:access-lists/ietf-acl:acl/ietf-acl:aces/ietf-acl:ace/ietf-acl:matc
hes/ietf-acl:ipv6-acl:

    +--rw fragments?   empty

The updated draft is uploaded to
https://github.com/dotswg/dots-data-channel/blob/master/draft-ietf-dots-data
-channel-08.txt 

Cheers,

-Tiru

From: Dots [mailto:[email-masked]] On Behalf Of Jon Shallow
Sent: Wednesday, November 22, 2017 9:30 PM
To: Konda, Tirumaleswar Reddy <[email-masked]>;
[email-masked]
Subject: Re: [Dots] Data Channel ACL Actions

Hi Tiru,

I think

    +--rw fragments?   empty

  augment

    +--rw fragments?   empty

  augment

    +--rw fragments?   empty

"deny": [null]

"deny": null

Regards

Jon

Hi Jon,

    +--rw dots-actions

       +--rw (packet-handling)?

          +--:(deny)

          |  +--rw deny?         empty

          +--:(permit)

          |  +--rw permit?       empty

          +--:(rate-limit)

    +--rw fragments?   empty

    +--rw dots-acl-order

 

-Tiru

Hi there,

 

   +--rw actions                        

   |  |  +--:(deny)              

   |  |  |  +--rw deny?      empty                      

   |  |  +--:(permit)                   

   |  |     +--rw permit?    empty                      

   |  +--rw logging?   Boolean

   +--rw actions

  {

      "client-identifier": [

       "iAYmCNPmrYoKoqzgFMiobw"

      ],

      "acl": [

          {

               "acl-type": "ipv4-acl",

               "aces": {

                   "ace": [

                       {

                           "rule-name": "rule1",

                           "matches": {

                             "ipv4-acl": {

                             }

                            },

                            "actions": {

                                "forwarding" : "drop"

                            }

                        }

                    ]

               }

          }

      ]

   }

  }

Regards

Jon

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Thu, 23 Nov 2017 14:18:10 +0000

Hi Jon,

Its defined as bytes per second (see Section 3.3.1) and the updated draft is using ":forwarding = 'accept'.

-Tiru

From: Jon Shallow [mailto:[email-masked]]
Sent: Thursday, November 23, 2017 7:29 PM
To: Konda, Tirumaleswar Reddy <[email-masked]>; [email-masked]
Subject: RE: [Dots] Data Channel ACL Actions

Hi Tiru,

I think the rate limiting needs to be defined as being in bytes per second or in bits per second for clarity.

I am a bit confused about your update - it is not the same as in draft-ietf-dots-data-channel-08.txt.
Also, should rate-limit only be there when :forwarding = 'accept', rather than a description telling you it is not there in the case of != 'accept'?

Regards

Jon

From: Konda, Tirumaleswar Reddy
Sent: Thursday, November 23, 2017 1:55 PM
To: 'Jon Shallow' <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]>
Subject: RE: [Dots] Data Channel ACL Actions

Hi Jon,

-Tiru

Cheers,
-Tiru

From: Dots [mailto:[email-masked]] On Behalf Of Jon Shallow
Sent: Wednesday, November 22, 2017 9:30 PM
To: Konda, Tirumaleswar Reddy <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]>
Subject: Re: [Dots] Data Channel ACL Actions

Hi Tiru,

I think

Regards

Jon

Hi Jon,

-Tiru

Hi there,

   +--rw actions

   +--rw actions

Regards

Jon

---

From: "Roland Dobbins" <[email-masked]>
Date: Thu, 23 Nov 2017 23:42:58 +0700

> draft is using ":forwarding = 'accept'.

If we're actually going to do this, it should be bits-per-second, 
because that's the unit which is universally used in the networking 
space.

Nobody uses bytes-per-second in networking.

---

From: "Jon Shallow" <[email-masked]>
Date: Thu, 23 Nov 2017 16:53:20 -0000

... apart from BGP FlowSpec .....

RFC5575

   Traffic-rate:  The traffic-rate extended community is a non-
      transitive extended community across the autonomous-system
      boundary and uses following extended community encoding:

         The first two octets carry the 2-octet id, which can be
         assigned from a 2-byte AS number.  When a 4-byte AS number is
         locally present, the 2 least significant bytes of such an AS
         number can be used.  This value is purely informational and
         should not be interpreted by the implementation.

         The remaining 4 octets carry the rate information in IEEE
         floating point [IEEE.754.1985] format, units being bytes per
         second.  A traffic-rate of 0 should result on all traffic for
         the particular flow to be discarded.

Regards

Jon

-----Original Message-----
From: Dots [mailto: [email-masked]] On Behalf Of Roland Dobbins
Sent: 23 November 2017 16:43
To: [email-masked]
Subject: Re: [Dots] Data Channel ACL Actions

> draft is using ":forwarding = 'accept'.

If we're actually going to do this, it should be bits-per-second, because
that's the unit which is universally used in the networking space.