Subject: [Dots] draft-ietf-dots-data-channel: RESTCONF/draft-ietf-netmod-acl-model

From: <[email-masked]>
Date: Mon, 22 Jan 2018 16:03:50 +0000

Hi all,

We started to integrate the changes in -15 version of the ACL YANG published last week. FWIW, a working copy of draft-ietf-dots-data-channel is available at:
https://github.com/boucadair/IETF-Drafts-Reviews/blob/master/wdiff%20draft-ietf-dots-data-channel-12.txt%20draft-ietf-dots-data-channel-13.pdf

We have many issues to be handled, but we will focus in this message on the one related to the ACL YANG module.

Because of the implications of augmenting the ACL module, we are struggling how to achieve the following operations using RESTCONF:

*         Retrieve a filtering entry (or all entries) created by a DOTS client. A DOTS client is allowed to see only its entries. The same acl name may be used by distinct DOTS clients.

*         Delete a filtering entry that was instantiated by a given DOTS client.

Those operations could be achieved if we managed to have a module that would look like the following:

       ...
       +--rw dots-client* [cuid]
          +--rw cuid    string
          +--rw cdid?   string
          +--rw acl* [name]
             +--rw name        string
             +--rw type?       acl-type
             +--rw lifetime    int32
             +--rw aces
                +--rw ace* [name]
                   +--rw name          string
                   +--rw matches
                   |  +--rw (l3)?
                   |  |  +--:(ipv4)
                     ..

Jon, Tiru, and muself are discussing the proposed updated module at: https://github.com/boucadair/IETF-Drafts-Reviews/blob/master/ietf-dots-data-channel%402018-01-22.yang

All: Can you please let us know if you have any objection if we proceed with that proposal instead of the augments?

Chairs: We do think that it would be useful to liaise with netmod WG to let them know about the DOTS requirements that are not easily met by augmenting the current ACL module. Further, we have investigated other alternate solutions such mount schema, but those are not suitable for what we want to achieve. Can you please let know how we should proceed?

Thank you.

Cheers,
Tiru & Med