Mahesh,
I've reviewed this model, I think I largely caused the last couple of
updates to it late last year. Overall I think it is a good model.
Placement of feature-statements could be debated - no clear answers.
object groupings is something I would like to see in the model but it
was always deferred.
On 2018-01-22 16:50, Kent Watsen wrote:
Hi Mahesh,
Thanks, it doesn't get much more concrete then a pull request ;)
Okay, so from a chair/shepherd perspective, can folks please consider
this update to -15 as the LC solution to removing the open issue Juergen
found in the draft?
As a contributor, I don't think the name of the groupings or their
description statements should allude to something that doesn't exist
yet. Rather than e.g. "source-or-group", could it be instead something
like "source-type"?
+1
Also, the update seems to be for both when
specifying networks as well as when specifying port-ranges, but the
original issue (see below) only mentioned addresses - is the
pull-request actually what's needed and the description of the issue in
Section 8 is incomplete?
8. Open Issues
o The current model does not support the concept of "containers"
used to contain multiple addresses per rule entry.
Object groupings are useful whenever there are many of something. There
are usually more address entries than ports, so perhaps more useful for
addresses, but it can still be useful to say "NFS-PORTS" and mean all
the ports that NFS use (god knows what they are).
Other have mentioned scale ACL and that it can be solved in other ways.
To me, this sort of object-groupings is not about optimising things for
the hardware but rather making it easy for me to write rules. I think it
is paramount for security that ACLs can be easily read and understood.
If we do not understand them, then we cannot say they are effective and
secure. Object groupings greatly improves the readability of ACLs and
thus makes it easier to write secure ACLs.
I understand the authors wishes to get the first version out the door
but I can't help but wonder if it isn't just easier to add in object
groupings now. It's not that damn complicated (they are just lists).
If not, I'm happy to work with them on the next version which could
include object groupings.
As for the PR to add choices, there seems to be an extra container
inserted. I also made a comment on GitHub.
At the very least, I think it would be best if this PR is fixed and
merged before we proceed.
kll
_______________________________________________
netmod mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/netmod
