Subject: [OPSAWG] MUD draft 13: ietf-acldns Another YANG question

From: "M. Ranganathan" <[email-masked]>
Date: Sun, 29 Oct 2017 09:12:18 -0400

I see that a grouping is used in ietf-acldns i.e.

 dns-matches {
    description "Domain names for matching.";

    leaf src-dnsname {
      type inet:host;
      description "domain name to be matched against";
    }
    leaf dst-dnsname {
      type inet:host;
      description "domain name to be matched against";
    }
  }

  augment "/acl:access-lists/acl:acl/acl:aces/acl:ace/" +
     "acl:matches/acl:ipv4-acl" {
    description "Adding domain names to matching";
    uses dns-matches;
   }

This allows src-dnsname and dst-dnsname to appear in from-device-policy and
to-device-policy.

Is it possible to restrict this such that src-dnsname only appears in
to-device-policy and dst-dnsname only appears in from-device-policy.

If not possible via YANG, can language be added to the spec to indicate the
restriction above?

Thanks,

Ranga.

-- 
M. Ranganathan

---

From: Eliot Lear <[email-masked]>
Date: Sun, 29 Oct 2017 15:47:28 +0100

On 10/29/17 2:12 PM, M. Ranganathan wrote:
> This allows src-dnsname and dst-dnsname to appear in
> from-device-policy and to-device-policy.
>
> If not possible via YANG, can language be added to the spec to
> indicate the restriction above?

I would have no objection adding some clarifying language in the draft.

Eliot
>
> Thanks,
>
> Ranga.
>
> -- 
> M. Ranganathan
>
>
> _______________________________________________
> OPSAWG mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/opsawg

---

From: "Einar Nilsen-Nygaard (einarnn)" <[email-masked]>
Date: Sun, 29 Oct 2017 22:58:02 +0000

It’s not entirely clear to me why we would try and do that, even if we could (which we can’t). I can see potentially sensible use cases where you may need both in the context of MUD. Also, the acldns model augmentation has broader applicability beyond MUD, so any attempt to impose MUD-specific restrictions would be a mistake.

If Eliot wishes to I add “here’s how we see this model being used in the context of MUD”, and make some best-practice recommendations, I’m fine with that. But it shouldn’t be a MUST NOT, IMO.

Cheers,

Einar

On Oct 29, 2017, at 14:48, Eliot Lear <[email-masked]<mailto:[email-masked]>> wrote:

 dns-matches {

    leaf src-dnsname {
      type inet:host;

This allows src-dnsname and dst-dnsname to appear in from-device-policy and to-device-policy.

Is it possible to restrict this such that src-dnsname only appears in to-device-policy and dst-dnsname only appears in from-device-policy.

If not possible via YANG, can language be added to the spec to indicate the restriction above?

Eliot

Thanks,

Ranga.

--
M. Ranganathan

_______________________________________________
OPSAWG mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/opsawg

_______________________________________________
OPSAWG mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/opsawg