draft-ietf-netmod-acl-model-07.txt   draft-ietf-netmod-acl-model-08.txt 
NETMOD WG D. Bogdanovic NETMOD WG D. Bogdanovic
Internet-Draft Internet-Draft Volta Networks
Intended status: Standards Track K. Sreenivasa Intended status: Standards Track K. Sreenivasa
Expires: September 12, 2016 Cisco Systems Expires: January 9, 2017 Cisco Systems
L. Huang L. Huang
Juniper Networks General Electric
D. Blair D. Blair
Cisco Systems Cisco Systems
March 11, 2016 July 08, 2016
Network Access Control List (ACL) YANG Data Model Network Access Control List (ACL) YANG Data Model
draft-ietf-netmod-acl-model-07 draft-ietf-netmod-acl-model-08
Abstract Abstract
This document describes a data model of Access Control List (ACL) This document describes a data model of Access Control List (ACL)
basic building blocks. basic building blocks.
Status of This Memo Status of This Memo
This Internet-Draft is submitted in full conformance with the This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79. provisions of BCP 78 and BCP 79.
skipping to change at page 1, line 36 skipping to change at page 1, line 36
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet- working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/. Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
This Internet-Draft will expire on September 12, 2016. This Internet-Draft will expire on January 9, 2017.
Copyright Notice Copyright Notice
Copyright (c) 2016 IETF Trust and the persons identified as the Copyright (c) 2016 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of (http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
skipping to change at page 2, line 17 skipping to change at page 2, line 17
Table of Contents Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
1.1. Definitions and Acronyms . . . . . . . . . . . . . . . . 3 1.1. Definitions and Acronyms . . . . . . . . . . . . . . . . 3
2. Problem Statement . . . . . . . . . . . . . . . . . . . . . . 3 2. Problem Statement . . . . . . . . . . . . . . . . . . . . . . 3
3. Design of the ACL Model . . . . . . . . . . . . . . . . . . . 4 3. Design of the ACL Model . . . . . . . . . . . . . . . . . . . 4
3.1. ACL Modules . . . . . . . . . . . . . . . . . . . . . . . 4 3.1. ACL Modules . . . . . . . . . . . . . . . . . . . . . . . 4
4. ACL YANG Models . . . . . . . . . . . . . . . . . . . . . . . 6 4. ACL YANG Models . . . . . . . . . . . . . . . . . . . . . . . 6
4.1. IETF Access Contorl List module . . . . . . . . . . . . . 6 4.1. IETF Access Contorl List module . . . . . . . . . . . . . 6
4.2. IETF-PACKET-FIELDS module . . . . . . . . . . . . . . . . 10 4.2. IETF-PACKET-FIELDS module . . . . . . . . . . . . . . . . 10
4.3. An ACL Example . . . . . . . . . . . . . . . . . . . . . 15 4.3. An ACL Example . . . . . . . . . . . . . . . . . . . . . 14
4.4. Port Range Usage Example . . . . . . . . . . . . . . . . 15 4.4. Port Range Usage Example . . . . . . . . . . . . . . . . 15
5. Linux nftables . . . . . . . . . . . . . . . . . . . . . . . 16 5. Linux nftables . . . . . . . . . . . . . . . . . . . . . . . 16
6. Security Considerations . . . . . . . . . . . . . . . . . . . 17 6. Security Considerations . . . . . . . . . . . . . . . . . . . 17
7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 17 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 17
8. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 18 8. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 18
9. References . . . . . . . . . . . . . . . . . . . . . . . . . 18 9. References . . . . . . . . . . . . . . . . . . . . . . . . . 18
9.1. Normative References . . . . . . . . . . . . . . . . . . 18 9.1. Normative References . . . . . . . . . . . . . . . . . . 18
9.2. Informative References . . . . . . . . . . . . . . . . . 19 9.2. Informative References . . . . . . . . . . . . . . . . . 19
Appendix A. Extending ACL model examples . . . . . . . . . . . . 19 Appendix A. Extending ACL model examples . . . . . . . . . . . . 19
A.1. Example of extending existing model for route filtering . 19 A.1. Example of extending existing model for route filtering . 19
A.2. A company proprietary module example . . . . . . . . . . 21 A.2. A company proprietary module example . . . . . . . . . . 21
A.3. Attaching Access Control List to interfaces . . . . . . . 24 A.3. Attaching Access Control List to interfaces . . . . . . . 25
A.4. Example to augment model with mixed ACL type . . . . . . 26 A.4. Example to augment model with mixed ACL type . . . . . . 27
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 26 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 27
1. Introduction 1. Introduction
Access Control List (ACL) is one of the basic elements to configure Access Control List (ACL) is one of the basic elements to configure
device forwarding behavior. It is used in many networking concepts device forwarding behavior. It is used in many networking concepts
such as Policy Based Routing, Firewalls etc. such as Policy Based Routing, Firewalls etc.
An ACL is an ordered set of rules that is used to filter traffic on a An ACL is an ordered set of rules that is used to filter traffic on a
networking device. Each rule is represented by an Access Control networking device. Each rule is represented by an Access Control
Entry (ACE). Entry (ACE).
Each ACE has a group of match criteria and a group of action Each ACE has a group of match criteria and a group of action
criteria. criteria.
The match criteria consist of a tuple of packet header match criteria The match criteria consist of a tuple of packet header match criteria
and metadata match criteria. and can have metadata match criteria as well.
o Packet header matches apply to fields visible in the packet such o Packet header matches apply to fields visible in the packet such
as address or class of service or port numbers. as address or class of service or port numbers.
o Metadata matches apply to fields associated with the packet but o In case vendor suppors it, metadata matches apply to fields
not in the packet header such as input interface or overall packet associated with the packet but not in the packet header such as
length input interface or overall packet length
The actions specify what to do with the packet when the matching The actions specify what to do with the packet when the matching
criteria is met. These actions are any operations that would apply criteria is met. These actions are any operations that would apply
to the packet, such as counting, policing, or simply forwarding.The to the packet, such as counting, policing, or simply forwarding.The
list of potential actions is endless depending on the innovations of list of potential actions is endless depending on the innovations of
the networked devices. the networked devices.
Access Control List is also widely knowns as ACL (pronounce as [ak-uh Access Control List is also widely knowns as ACL (pronounce as [ak-uh
l]) or Access List. In this document, Access Control List, ACL and l]) or Access List. In this document, Access Control List, ACL and
Access List are interchangeable. Access List are interchangeable.
skipping to change at page 4, line 12 skipping to change at page 4, line 12
draft proposes a simple model that can be augmented by standard draft proposes a simple model that can be augmented by standard
extensions and vendor proprietary models. extensions and vendor proprietary models.
3. Design of the ACL Model 3. Design of the ACL Model
Although different vendors have different ACL data models, there is a Although different vendors have different ACL data models, there is a
common understanding of what access control list (ACL) is. A network common understanding of what access control list (ACL) is. A network
system usually have a list of ACLs, and each ACL contains an ordered system usually have a list of ACLs, and each ACL contains an ordered
list of rules, also known as access list entries - ACEs. Each ACE list of rules, also known as access list entries - ACEs. Each ACE
has a group of match criteria and a group of action criteria. The has a group of match criteria and a group of action criteria. The
match criteria consist of packet header matching and metadata match criteria consist of packet header matching. It as also
matching. Packet header matching applies to fields visible in the possible for ACE to match on metadata, if supported by the vendor.
packet such as address or class of service or port numbers. Metadata Packet header matching applies to fields visible in the packet such
matching applies to fields associated with the packet, but not in the as address or class of service or port numbers. Metadata matching
packet header such as input interface, packet length, or source or applies to fields associated with the packet, but not in the packet
header such as input interface, packet length, or source or
destination prefix length. The actions can be any sort of operation destination prefix length. The actions can be any sort of operation
from logging to rate limiting or dropping to simply forwarding. from logging to rate limiting or dropping to simply forwarding.
Actions on the first matching ACE are applied with no processing of Actions on the first matching ACE are applied with no processing of
subsequent ACEs. The model also includes a container to hold overall subsequent ACEs. The model also includes a container to hold overall
operational state for each ACL and operational state for each ACE. operational state for each ACL and operational state for each ACE.
One ACL can be applied to multiple targets within the device, such as One ACL can be applied to multiple targets within the device, such as
interfaces of a networked device, applications or features running in interfaces of a networked device, applications or features running in
the device, etc. When applied to interfaces of a networked device, the device, etc. When applied to interfaces of a networked device,
the ACL is applied in a direction which indicates if it should be the ACL is applied in a direction which indicates if it should be
applied to packet entering (input) or leaving the device (output). applied to packet entering (input) or leaving the device (output).
skipping to change at page 5, line 16 skipping to change at page 5, line 16
+--rw access-lists +--rw access-lists
+--rw acl* [acl-type acl-name] +--rw acl* [acl-type acl-name]
+--rw acl-name string +--rw acl-name string
+--rw acl-type acl-type +--rw acl-type acl-type
+--ro acl-oper-data +--ro acl-oper-data
+--rw access-list-entries +--rw access-list-entries
+--rw ace* [rule-name] +--rw ace* [rule-name]
+--rw rule-name string +--rw rule-name string
+--rw matches +--rw matches
| +--rw (ace-type)? | +--rw (ace-type)?
| | +--:(ace-ip) | +--:(ace-ip)
| | | +--rw (ace-ip-version)? | | +--rw (ace-ip-version)?
| | | | +--:(ace-ipv4) | | | +--:(ace-ipv4)
| | | | | +--rw destination-ipv4-network? inet:ipv4-prefix | | | | +--rw destination-ipv4-network? inet:ipv4-prefix
| | | | | +--rw source-ipv4-network? inet:ipv4-prefix | | | | +--rw source-ipv4-network? inet:ipv4-prefix
| | | | +--:(ace-ipv6) | | | +--:(ace-ipv6)
| | | | +--rw destination-ipv6-network? inet:ipv6-prefix | | | +--rw destination-ipv6-network? inet:ipv6-prefix
| | | | +--rw source-ipv6-network? inet:ipv6-prefix | | | +--rw source-ipv6-network? inet:ipv6-prefix
| | | | +--rw flow-label? inet:ipv6-flow-label | | | +--rw flow-label? inet:ipv6-flow-label
| | | +--rw dscp? inet:dscp | | +--rw dscp? inet:dscp
| | | +--rw protocol? uint8 | | +--rw protocol? uint8
| | | +--rw source-port-range! | | +--rw source-port-range!
| | | | +--rw lower-port inet:port-number | | | +--rw lower-port inet:port-number
| | | | +--rw upper-port? inet:port-number | | | +--rw upper-port? inet:port-number
| | | +--rw destination-port-range! | | +--rw destination-port-range!
| | | +--rw lower-port inet:port-number | | +--rw lower-port inet:port-number
| | | +--rw upper-port? inet:port-number | | +--rw upper-port? inet:port-number
| | +--:(ace-eth) | +--:(ace-eth)
| | +--rw destination-mac-address? yang:mac-address | +--rw destination-mac-address? yang:mac-address
| | +--rw destination-mac-address-mask? yang:mac-address | +--rw destination-mac-address-mask? yang:mac-address
| | +--rw source-mac-address? yang:mac-address | +--rw source-mac-address? yang:mac-address
| | +--rw source-mac-address-mask? yang:mac-address | +--rw source-mac-address-mask? yang:mac-address
| +--rw input-interface? if:interface-ref
+--rw actions +--rw actions
| +--rw (packet-handling)? | +--rw (packet-handling)?
| +--:(deny) | +--:(deny)
| | +--rw deny? empty | | +--rw deny? empty
| +--:(permit) | +--:(permit)
| +--rw permit? empty | +--rw permit? empty
+--ro ace-oper-data +--ro ace-oper-data
+--ro match-counter? yang:counter64 +--ro match-counter? yang:counter64
Figure 1 Figure 1
skipping to change at page 6, line 20 skipping to change at page 6, line 20
access lists. The "access-lists" container stores a list of "acl". access lists. The "access-lists" container stores a list of "acl".
Each "acl" has information identifying the access list by a Each "acl" has information identifying the access list by a
name("acl-name") and a list("access-list-entries") of rules name("acl-name") and a list("access-list-entries") of rules
associated with the "acl-name". Each of the entries in the associated with the "acl-name". Each of the entries in the
list("access-list-entries"), indexed by the string "rule-name", has list("access-list-entries"), indexed by the string "rule-name", has
containers defining "matches" and "actions". The "matches" define containers defining "matches" and "actions". The "matches" define
criteria used to identify patterns in "ietf-packet-fields". The criteria used to identify patterns in "ietf-packet-fields". The
"actions" define behavior to undertake once a "match" has been "actions" define behavior to undertake once a "match" has been
identified. identified.
<CODE BEGINS>file "ietf-access-control-list@2016-02-18.yang" <CODE BEGINS>file "ietf-access-control-list@2016-07-08.yang"
module ietf-access-control-list { module ietf-access-control-list {
yang-version "1.1"; yang-version 1.1;
namespace "urn:ietf:params:xml:ns:yang:ietf-access-control-list"; namespace "urn:ietf:params:xml:ns:yang:ietf-access-control-list";
prefix acl; prefix acl;
import ietf-yang-types { import ietf-yang-types {
prefix yang; prefix yang;
} }
import ietf-packet-fields { import ietf-packet-fields {
prefix packet-fields; prefix packet-fields;
} }
organization "IETF NETMOD (NETCONF Data Modeling Language) organization "IETF NETMOD (NETCONF Data Modeling Language)
Working Group"; Working Group";
skipping to change at page 6, line 45 skipping to change at page 6, line 45
WG List: netmod@ietf.org WG List: netmod@ietf.org
WG Chair: Juergen Schoenwaelder WG Chair: Juergen Schoenwaelder
j.schoenwaelder@jacobs-university.de j.schoenwaelder@jacobs-university.de
WG Chair: Tom Nadeau WG Chair: Tom Nadeau
tnadeau@lucidvision.com tnadeau@lucidvision.com
Editor: Dean Bogdanovic Editor: Dean Bogdanovic
ivandean@gmail.com ivandean@gmail.com
Editor: Kiran Agrahara Sreenivasa Editor: Kiran Agrahara Sreenivasa
kkoushik@cisco.com kkoushik@cisco.com
Editor: Lisa Huang Editor: Lisa Huang
lyihuang@juniper.net lyihuang16@gmail.com
Editor: Dana Blair Editor: Dana Blair
dblair@cisco.com"; dblair@cisco.com";
description description
"This YANG module defines a component that describing the "This YANG module defines a component that describing the
configuration of Access Control Lists (ACLs). configuration of Access Control Lists (ACLs).
Copyright (c) 2016 IETF Trust and the persons identified as Copyright (c) 2016 IETF Trust and the persons identified as
the document authors. All rights reserved. the document authors. All rights reserved.
Redistribution and use in source and binary forms, with or Redistribution and use in source and binary forms, with or
without modification, is permitted pursuant to, and subject without modification, is permitted pursuant to, and subject
to the license terms contained in, the Simplified BSD to the license terms contained in, the Simplified BSD
License set forth in Section 4.c of the IETF Trust's Legal License set forth in Section 4.c of the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info). (http://trustee.ietf.org/license-info).
This version of this YANG module is part of RFC XXXX; see This version of this YANG module is part of RFC XXXX; see
the RFC itself for full legal notices."; the RFC itself for full legal notices.";
revision 2016-02-18 { revision 2016-07-08 {
description description
"Base model for Network Access Control List (ACL)."; "Base model for Network Access Control List (ACL).";
reference reference
"RFC XXXX: Network Access Control List (ACL) "RFC XXXX: Network Access Control List (ACL)
YANG Data Model"; YANG Data Model";
} }
identity acl-base { identity acl-base {
description description
"Base Access Control List type for all Access Control List type "Base Access Control List type for all Access Control List type
identifiers."; identifiers.";
skipping to change at page 9, line 44 skipping to change at page 9, line 44
} }
} }
uses packet-fields:acl-ip-header-fields; uses packet-fields:acl-ip-header-fields;
} }
case ace-eth { case ace-eth {
description description
"Ethernet Access List entry."; "Ethernet Access List entry.";
uses packet-fields:acl-eth-header-fields; uses packet-fields:acl-eth-header-fields;
} }
} }
uses packet-fields:metadata;
} }
container actions { container actions {
description description
"Definitions of action criteria for this Access List "Definitions of action criteria for this Access List
Entry."; Entry.";
choice packet-handling { choice packet-handling {
default "deny"; default "deny";
description description
"Packet handling action."; "Packet handling action.";
case deny { case deny {
skipping to change at page 10, line 42 skipping to change at page 10, line 41
} }
} }
} }
} }
} }
<CODE ENDS> <CODE ENDS>
4.2. IETF-PACKET-FIELDS module 4.2. IETF-PACKET-FIELDS module
The packet fields module defines the necessary groups for matching on The packet fields module defines the necessary groups for matching on
fields in the packet including ethernet, ipv4, ipv6, transport layer fields in the packet including ethernet, ipv4, ipv6, and transport
fields and metadata. Since the number of match criteria is very layer fields. Since the number of match criteria is very large, the
large, the base draft does not include these directly but references base draft does not include these directly but references them by
them by "uses" to keep the base module simple. In case more match "uses" to keep the base module simple. In case more match conditions
conditions are needed, those can be added by augmenting choices are needed, those can be added by augmenting choices within container
within container "matches" in ietf-access-control-list.yang model "matches" in ietf-access-control-list.yang model.
<CODE BEGINS>file "ietf-packet-fields@2016-02-18.yang" <CODE BEGINS>file "ietf-packet-fields@2016-07-08.yang"
module ietf-packet-fields { module ietf-packet-fields {
yang-version "1.1"; yang-version 1.1;
namespace "urn:ietf:params:xml:ns:yang:ietf-packet-fields"; namespace "urn:ietf:params:xml:ns:yang:ietf-packet-fields";
prefix packet-fields; prefix packet-fields;
import ietf-inet-types { import ietf-inet-types {
prefix inet; prefix inet;
} }
import ietf-yang-types { import ietf-yang-types {
prefix yang; prefix yang;
} }
import ietf-interfaces {
prefix if;
}
organization "IETF NETMOD (NETCONF Data Modeling Language) Working organization "IETF NETMOD (NETCONF Data Modeling Language) Working
Group"; Group";
contact contact
"WG Web: http://tools.ietf.org/wg/netmod/ "WG Web: http://tools.ietf.org/wg/netmod/
WG List: netmod@ietf.org WG List: netmod@ietf.org
WG Chair: Juergen Schoenwaelder WG Chair: Juergen Schoenwaelder
j.schoenwaelder@jacobs-university.de j.schoenwaelder@jacobs-university.de
WG Chair: Tom Nadeau WG Chair: Tom Nadeau
tnadeau@lucidvision.com tnadeau@lucidvision.com
Editor: Dean Bogdanovic Editor: Dean Bogdanovic
deanb@juniper.net deanb@juniper.net
Editor: Kiran Agrahara Sreenivasa Editor: Kiran Agrahara Sreenivasa
kkoushik@cisco.com kkoushik@cisco.com
Editor: Lisa Huang Editor: Lisa Huang
lyihuang@juniper.net lyihuang16@gmail.com
Editor: Dana Blair Editor: Dana Blair
dblair@cisco.com"; dblair@cisco.com";
description description
"This YANG module defines groupings that are used by "This YANG module defines groupings that are used by
ietf-access-control-list YANG module. Their usage is not ietf-access-control-list YANG module. Their usage is not
limited to ietf-access-control-list and can be limited to ietf-access-control-list and can be
used anywhere as applicable. used anywhere as applicable.
Copyright (c) 2016 IETF Trust and the persons identified as Copyright (c) 2016 IETF Trust and the persons identified as
the document authors. All rights reserved. the document authors. All rights reserved.
Redistribution and use in source and binary forms, with or Redistribution and use in source and binary forms, with or
without modification, is permitted pursuant to, and subject without modification, is permitted pursuant to, and subject
to the license terms contained in, the Simplified BSD to the license terms contained in, the Simplified BSD
License set forth in Section 4.c of the IETF Trust's Legal License set forth in Section 4.c of the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info). (http://trustee.ietf.org/license-info).
This version of this YANG module is part of RFC XXXX; see This version of this YANG module is part of RFC XXXX; see
the RFC itself for full legal notices."; the RFC itself for full legal notices.";
revision 2016-02-18 { revision 2016-07-08 {
description description
"Initial version of packet fields used by "Initial version of packet fields used by
ietf-access-control-list"; ietf-access-control-list";
reference reference
"RFC XXXX: Network Access Control List (ACL) "RFC XXXX: Network Access Control List (ACL)
YANG Data Model"; YANG Data Model";
} }
grouping acl-transport-header-fields { grouping acl-transport-header-fields {
description description
"Transport header fields"; "Transport header fields";
skipping to change at page 12, line 26 skipping to change at page 12, line 22
type inet:port-number; type inet:port-number;
mandatory true; mandatory true;
description description
"Lower boundary for port."; "Lower boundary for port.";
} }
leaf upper-port { leaf upper-port {
type inet:port-number; type inet:port-number;
must ". >= ../lower-port" { must ". >= ../lower-port" {
error-message error-message
"The upper-port must be greater than or equal to lower-port"; "The upper-port must be greater than or equal to lower-port";
description "Upper boundary port value check.";
} }
description description
"Upper boundary for port. If existing, the upper port "Upper boundary for port . If existing, the upper port
must be greater or equal to lower-port."; must be greater or equal to lower-port.";
} }
} }
container destination-port-range { container destination-port-range {
presence "Enables setting destination port range"; presence "Enables setting destination port range";
description description
"Inclusive range representing destination ports to be used. When "Inclusive range representing destination ports to be used. When
only lower-port is present, it represents a single port."; only lower-port is present, it represents a single port.";
leaf lower-port { leaf lower-port {
type inet:port-number; type inet:port-number;
mandatory true; mandatory true;
description description
"Lower boundary for port."; "Lower boundary for port.";
} }
leaf upper-port { leaf upper-port {
type inet:port-number; type inet:port-number;
must ". >= ../lower-port" { must ". >= ../lower-port" {
error-message error-message
"The upper-port must be greater than or equal to lower-port"; "The upper-port must be greater than or equal to lower-port";
description "Upper boundary port value check.";
} }
description description
"Upper boundary for port. If existing, the upper port must "Upper boundary for port. If existing, the upper port must
be greater or equal to lower-port"; be greater or equal to lower-port";
} }
} }
} }
grouping acl-ip-header-fields { grouping acl-ip-header-fields {
description description
"IP header fields common to ipv4 and ipv6"; "IP header fields common to ipv4 and ipv6";
leaf dscp { leaf dscp {
skipping to change at page 14, line 42 skipping to change at page 14, line 36
leaf source-mac-address-mask { leaf source-mac-address-mask {
type yang:mac-address; type yang:mac-address;
description description
"Source IEEE 802 MAC address mask."; "Source IEEE 802 MAC address mask.";
} }
reference reference
"IEEE 802: IEEE Standard for Local and Metropolitan Area "IEEE 802: IEEE Standard for Local and Metropolitan Area
Networks: Overview and Architecture."; Networks: Overview and Architecture.";
} }
grouping metadata {
description
"Fields associated with a packet whick are not in
the header.";
leaf input-interface {
type if:interface-ref {
require-instance false;
}
description
"Packet was received on this interface.";
}
}
} }
<CODE ENDS> <CODE ENDS>
4.3. An ACL Example 4.3. An ACL Example
Requirement: Deny All traffic from 10.10.10.1/24. Requirement: Deny All traffic from 10.10.10.1/24.
Here is the acl configuration xml for this Access Control List: Here is the acl configuration xml for this Access Control List:
<?xml version='1.0' encoding='UTF-8'?> <?xml version='1.0' encoding='UTF-8'?>
skipping to change at page 19, line 15 skipping to change at page 19, line 10
[RFC6241] Enns, R., Ed., Bjorklund, M., Ed., Schoenwaelder, J., Ed., [RFC6241] Enns, R., Ed., Bjorklund, M., Ed., Schoenwaelder, J., Ed.,
and A. Bierman, Ed., "Network Configuration Protocol and A. Bierman, Ed., "Network Configuration Protocol
(NETCONF)", RFC 6241, DOI 10.17487/RFC6241, June 2011, (NETCONF)", RFC 6241, DOI 10.17487/RFC6241, June 2011,
<http://www.rfc-editor.org/info/rfc6241>. <http://www.rfc-editor.org/info/rfc6241>.
[RFC6242] Wasserman, M., "Using the NETCONF Protocol over Secure [RFC6242] Wasserman, M., "Using the NETCONF Protocol over Secure
Shell (SSH)", RFC 6242, DOI 10.17487/RFC6242, June 2011, Shell (SSH)", RFC 6242, DOI 10.17487/RFC6242, June 2011,
<http://www.rfc-editor.org/info/rfc6242>. <http://www.rfc-editor.org/info/rfc6242>.
[RFC6536] Bierman, A. and M. Bjorklund, "Network Configuration [RFC6536] Bierman, A. and M. Bjorklund, "Network Configuration
Protocol (NETCONF) Access Control Model", RFC 6536, Protocol (NETCONF) Access Control Model", RFC 6536, DOI
DOI 10.17487/RFC6536, March 2012, 10.17487/RFC6536, March 2012,
<http://www.rfc-editor.org/info/rfc6536>. <http://www.rfc-editor.org/info/rfc6536>.
9.2. Informative References 9.2. Informative References
[RFC5101] Claise, B., Ed., "Specification of the IP Flow Information [RFC5101] Claise, B., Ed., "Specification of the IP Flow Information
Export (IPFIX) Protocol for the Exchange of IP Traffic Export (IPFIX) Protocol for the Exchange of IP Traffic
Flow Information", RFC 5101, DOI 10.17487/RFC5101, January Flow Information", RFC 5101, DOI 10.17487/RFC5101, January
2008, <http://www.rfc-editor.org/info/rfc5101>. 2008, <http://www.rfc-editor.org/info/rfc5101>.
Appendix A. Extending ACL model examples Appendix A. Extending ACL model examples
skipping to change at page 19, line 45 skipping to change at page 19, line 40
extend existing ACL model with route filtering. The combination of a extend existing ACL model with route filtering. The combination of a
route prefix and prefix length along with the type of match route prefix and prefix length along with the type of match
determines how route filters are evaluated against incoming routes. determines how route filters are evaluated against incoming routes.
Different vendors have different match types and in this model we are Different vendors have different match types and in this model we are
using only ones that are common across all vendors participating in using only ones that are common across all vendors participating in
this draft. As in this example, the base ACL model can be extended this draft. As in this example, the base ACL model can be extended
with company proprietary extensions, described in the next section. with company proprietary extensions, described in the next section.
file "example-ext-route-filter@2016-02-18.yang" file "example-ext-route-filter@2016-02-18.yang"
module example-ext-route-filter { module example-ext-route-filter {
yang-version 1; yang-version 1.1;
namespace "urn:ietf:params:xml:ns:yang:example-ext-route-filter"; namespace "urn:ietf:params:xml:ns:yang:example-ext-route-filter";
prefix example-ext-route-filter; prefix example-ext-route-filter;
import ietf-inet-types { import ietf-inet-types {
prefix "inet"; prefix "inet";
} }
import ietf-access-control-list { import ietf-access-control-list {
prefix "ietf-acl"; prefix "ietf-acl";
} }
organization organization
"Route model group."; "Route model group.";
contact contact
"abc@abc.com"; "abc@abc.com";
description " description "
This module describes route filter as a collection of This module describes route filter as a collection of
skipping to change at page 21, line 33 skipping to change at page 21, line 29
Module "example-newco-acl" is an example of company proprietary model Module "example-newco-acl" is an example of company proprietary model
that augments "ietf-acl" module. It shows how to use 'augment' with that augments "ietf-acl" module. It shows how to use 'augment' with
an XPath expression to add additional match criteria, action an XPath expression to add additional match criteria, action
criteria, and default actions when no ACE matches found. All these criteria, and default actions when no ACE matches found. All these
are company proprietary extensions or system feature extensions. are company proprietary extensions or system feature extensions.
"example-newco-acl" is just an example and it is expected from "example-newco-acl" is just an example and it is expected from
vendors to create their own proprietary models. vendors to create their own proprietary models.
The following figure is the tree structure of example-newco-acl. In The following figure is the tree structure of example-newco-acl. In
this example, /ietf-acl:access-lists/ietf-acl:acl/ietf-acl:access- this example, /ietf-acl:access-lists/ietf-acl:acl/ietf-acl:access-
list-entries/ ietf-acl:ace/ietf-acl:matches are augmented with a new list-entries/ ietf-acl:ace/ietf-acl:matches are augmented with two
choice, protocol-payload-choice. The protocol-payload-choice uses a new choices, protocol-payload-choice and metadata. The protocol-
grouping with an enumeration of all supported protocol values. In payload-choice uses a grouping with an enumeration of all supported
other example, /ietf-acl:access-lists/ietf-acl:acl/ietf-acl:access- protocol values. Metadata matches apply to fields associated with
list-entries/ ietf-acl:ace/ietf-acl:actions are augmented with new the packet but not in the packet header such as input interface or
choice of actions. overall packet length. In other example, /ietf-acl:access-lists/
ietf-acl:acl/ietf-acl:access-list-entries/ ietf-acl:ace/ietf-
acl:actions are augmented with new choice of actions.
module: example-newco-acl module: example-newco-acl
augment /ietf-acl:access-lists/ietf-acl:acl/ietf-acl:access-list-entries/ augment /ietf-acl:access-lists/ietf-acl:acl/ietf-acl:access-list-entries/
ietf-acl:ace/ietf-acl:matches: ietf-acl:ace/ietf-acl:matches:
+--rw (protocol-payload-choice)? +--rw (protocol-payload-choice)?
+--:(protocol-payload) | +--:(protocol-payload)
+--rw protocol-payload* [value-keyword] | +--rw protocol-payload* [value-keyword]
+--rw value-keyword enumeration | +--rw value-keyword enumeration
augment /ietf-acl:access-lists/ietf-acl:acl/ietf-acl:access-list-entries/ +--rw (metadata)?
+--:(interface-name)
+--rw interface-name* [input-interface]
+--rw input-interface if:interface-ref
augment /ietf-acl:access-lists/ietf-acl:acl/ietf-acl:access-list-entries/
ietf-acl:ace/ietf-acl:actions: ietf-acl:ace/ietf-acl:actions:
+--rw (action)? +--rw (action)?
+--:(count) +--:(count)
| +--rw count? string | +--rw count? string
+--:(policer) +--:(policer)
| +--rw policer? string | +--rw policer? string
+--:(hiearchical-policer) +--:(hiearchical-policer)
+--rw hierarchitacl-policer? string +--rw hierarchitacl-policer? string
augment /ietf-acl:access-lists/ietf-acl:acl: augment /ietf-acl:access-lists/ietf-acl:acl:
+--rw default-actions +--rw default-actions
+--rw deny? empty +--rw deny? empty
file "newco-acl@2016-02-18.yang" file "newco-acl@2016-07-08.yang"
module example-newco-acl { module example-newco-acl {
yang-version 1; yang-version 1.1;
namespace "urn:newco:params:xml:ns:yang:example-newco-acl"; namespace "urn:newco:params:xml:ns:yang:example-newco-acl";
prefix example-newco-acl; prefix example-newco-acl;
import ietf-access-control-list { import ietf-access-control-list {
prefix "ietf-acl"; prefix "ietf-acl";
} }
import ietf-interfaces {
prefix if;
}
organization organization
"Newco model group."; "Newco model group.";
contact contact
"abc@newco.com"; "abc@newco.com";
description description
"This YANG module augment IETF ACL Yang."; "This YANG module augment IETF ACL Yang.";
revision 2016-02-18{ revision 2016-07-08{
description description
"Creating NewCo proprietary extensions to ietf-acl model"; "Creating NewCo proprietary extensions to ietf-acl model";
reference reference
"RFC XXXX: Network Access Control List (ACL) "RFC XXXX: Network Access Control List (ACL)
YANG Data Model"; YANG Data Model";
} }
augment "/ietf-acl:access-lists/ietf-acl:acl/ietf-acl:access-list-entries/ietf-acl:ace/ietf-acl:matches" { augment "/ietf-acl:access-lists/ietf-acl:acl/ietf-acl:access-list-entries/ietf-acl:ace/ietf-acl:matches" {
description "Newco proprietary simple filter matches"; description "Newco proprietary simple filter matches";
choice protocol-payload-choice { choice protocol-payload-choice {
description ""; description "Newo proprietary payload match condition";
list protocol-payload { list protocol-payload {
key value-keyword; key value-keyword;
ordered-by user; ordered-by user;
description "Match protocol payload"; description "Match protocol payload";
uses match-simple-payload-protocol-value; uses match-simple-payload-protocol-value;
} }
} }
choice metadata {
description "Newco proprietary interface match condition";
list interface-name {
key input-interface;
ordered-by user;
description "Match interface name";
uses metadata;
}
}
} }
augment "/ietf-acl:access-lists/ietf-acl:acl/ietf-acl:access-list-entries/ietf-acl:ace/ietf-acl:actions" { augment "/ietf-acl:access-lists/ietf-acl:acl/ietf-acl:access-list-entries/ietf-acl:ace/ietf-acl:actions" {
description "Newco proprietary simple filter actions"; description "Newco proprietary simple filter actions";
choice action { choice action {
description ""; description "";
case count { case count {
description "Count the packet in the named counter"; description "Count the packet in the named counter";
leaf count { leaf count {
type string; type string;
skipping to change at page 24, line 10 skipping to change at page 24, line 27
container default-actions { container default-actions {
description description
"Actions that occur if no access-list entry is matched."; "Actions that occur if no access-list entry is matched.";
leaf deny { leaf deny {
type empty; type empty;
description ""; description "";
} }
} }
} }
grouping metadata {
description
"Fields associated with a packet which are not in
the header.";
leaf input-interface {
type if:interface-ref {
require-instance false;
}
description
"Packet was received on this interface";
}
}
grouping match-simple-payload-protocol-value { grouping match-simple-payload-protocol-value {
description "Newco proprietary payload"; description "Newco proprietary payload";
leaf value-keyword { leaf value-keyword {
type enumeration { type enumeration {
enum icmp { enum icmp {
description "Internet Control Message Protocol"; description "Internet Control Message Protocol";
} }
enum icmp6 { enum icmp6 {
description "Internet Control Message Protocol Version 6"; description "Internet Control Message Protocol Version 6";
} }
skipping to change at page 25, line 14 skipping to change at page 26, line 14
import ietf-access-control-list { import ietf-access-control-list {
prefix "ietf-acl"; prefix "ietf-acl";
} }
import ietf-interface { import ietf-interface {
prefix "ietf-if"; prefix "ietf-if";
} }
import ietf-yang-types { import ietf-yang-types {
prefix "yang"; prefix "yang";
} }
import example-newco-acl {
prefix "example-newco";
}
augment "/ietf-if:interfaces/ietf-if:interface" { augment "/ietf-if:interfaces/ietf-if:interface" {
description "Apply ACL to interfaces"; description "Apply ACL to interfaces";
container acl{ container acl{
description "ACL related properties."; description "ACL related properties.";
leaf acl-name { leaf acl-name {
type ietf-acl:acl-ref; type ietf-acl:acl-ref;
mandatory true; mandatory true;
description "Access Control List name."; description "Access Control List name.";
} }
skipping to change at page 26, line 34 skipping to change at page 27, line 34
description "ACL that contains a mix of entries that description "ACL that contains a mix of entries that
primarily match on fields in ethernet headers, entries primarily match on fields in ethernet headers, entries
that primarily match on fields in IPv4 headers, and entries that primarily match on fields in IPv4 headers, and entries
that primarily match on fields in IPv6 headers. Matching on that primarily match on fields in IPv6 headers. Matching on
layer 4 header fields may also exist in the list."; layer 4 header fields may also exist in the list.";
} }
Authors' Addresses Authors' Addresses
Dean Bogdanovic Dean Bogdanovic
Volta Networks
Email: ivandean@gmail.com Email: ivandean@gmail.com
Kiran Agrahara Sreenivasa Kiran Agrahara Sreenivasa
Cisco Systems Cisco Systems
Email: kkoushik@cisco.com Email: kkoushik@cisco.com
Lisa Huang Lisa Huang
Juniper Networks General Electric
Email: lyihuang@juniper.net Email: lyihuang16@gmail.com
Dana Blair Dana Blair
Cisco Systems Cisco Systems
Email: dblair@cisco.com Email: dblair@cisco.com
 End of changes. 45 change blocks. 
97 lines changed or deleted 114 lines changed or added

This html diff was produced by rfcdiff 1.45. The latest version is available from http://tools.ietf.org/tools/rfcdiff/