| I2RS working group | S. Hares |
| Internet-Draft | Q. Wu |
| Intended status: Standards Track | Huawei |
| Expires: March 30, 2015 | September 26, 2014 |
An Information Model for Basic Network Policy
draft-hares-i2rs-bnp-info-model-00
This document contains three information Models: Basic Network Policy (BNP IM). ACLs do not provide all the policy support required by BGP, Policy Based Routing (PBR), SFC Topology Information Model (SF-Topo IM), Service Forwarding Chaing IM (SFC IM), and and flow specification filtering. The BNP IM has the following top-down levels of Policy Hierarchy: Policy Set, Policy Group, Policy Rule, and conditional actions within the policy rule (conditional match and Actions). These can be used in PBR-RIB or BGP to provide an ordered set of policy rules grouped with a Policy Group via operators (AND, OR, etc.) and ordered by a combination of priority and precedence. The Policy is an ordered set of Policy Groups.
The BNP IM is based on the concept of an extensible information model for representing policies. This concept is also found in the Policy Core Information Model (PCIM) (RFC3060) and the Quality of Service (QoS) Policy Information Model (QPIM)(RFC3644) and policy based routing.
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."
This Internet-Draft will expire on March 30, 2015.
Copyright (c) 2014 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
The Interface to the Routing System (I2RS) provides read and write access to the information and state within the routing process within routing elements. The I2RS client interacts with one or more I2RS agents to collect information from network routing systems.
Processing of collected information at the I2RS agent may require the I2RS Agent to filter certain information or group pieces of information in order to reduce the data flow through the network to the I2RS client. Some applications that that utilize the services of I2RS client may also wish to require specific data in response to network events or conditions based on pre-established rules. This functionality is necessary to meet the requirements of i2rs enabled services which include service-layer routing improvements, and control of traffic flows and exit points.
This document introduces a Basic Network Policy information model (BNP IM) to handle policies related to the network. This basic policy model can be easily extended beyond the basic functions. The [I-D.ietf-i2rs-architecture] suggests that associated with the I2RS RIB model there will be "Policy-based Routing (ACLs)" and RIB "policy controls". These basic policy functions can operate as part of this functional blocks providing the basic model for policy operators. This model can also be considered as the substance of the policy templates.
The BNP IM is extensible allowing other extensions to make the BNP IM policy adaptable to specific I2RS protocol features. This policy model can be linked with other information models such as the following:
The BNP IM model is a product of the industry approach to I2RS that standardizes on a few basic network functions to obtain quick deployment of initial I2RS RIB modules, and build on this success to create network functions. Additional I2RS modules add I2RS interfaces to policy-based routing, BGP, Service topology creation, Service Chaining functions, and policy templates.
This information model leveraged previous work done on extensible information model for representing policies. This work included the Policy Core Information Model (PCIM) [RFC3060] [RFC3060], and an extension to this model to address the need for QoS management, called the Quality of Service (QoS) Policy Information Model (QPIM) [RFC3644] [RFC3644].
Most policy within routing and forwarding systems has become hierarchical with individual specific policies being grouped as a policy set. The hierarchical policy rule definition enhances policy readability and reusability. Groups of network policies have labels to aid operational use. Named groups of policy are easily identified and reused as blocks.
The Basic Network Policy information model contains the following three components:
This draft contains the Basic Network-Policy Information Model (BNP IM). BNP IM is a generic network policy model. It can be thought of as a coherent set of rules to administer, manage, and control access to network resources and defines a network policy at its most general level of abstraction. It models aspects such as actions and conditions that constitute a policy element relationship, as well as operators contained in the both condition and action that can either be used to overwrite an old value of the variable or imply match relationship.
I2RS needs its own implicit and explicit policy. This section provides an overview of the network policy model. The network policy model is defined by the following components, whose relationship is roughly depicted in the figure below.
+-----------------------+
| Network-Policy |
+-----------+-----------+
^
/|\
| "extends"
+-----------^-------------+
| Policy Set |
+--+-------------------+--+
^ ^
/|\ /|\
+------------+ +--------------+
|Policy Group| | Policy Group |
+------------+ +--------------+
^ ^ +----------------+
| | ---|ACL Policy-Rule |
| | | | Additions |
| | | +----------------+
| "extends" | "extends" | +----------------+
+--------^-------+ +-------^-------+ |--|PBR Policy-Rule |
| Policy Rule | | Policy Rule |<----| Additions |
+----------------+ +---------------+ | +----------------+
: : | . . .
: : | +---------------+
......: :..... ---|RIB Policy-Rule|
: : | Additions |
: : +---------------+
: :
+---------V---------+ +-V-------------+
| Policy Condition | | Policy Action |
+-------------------+ +---------------+
: : : : : :
.....: . :..... .....: . :.....
: : : : : :
+----V---+ +---V----+ +--V---+ +-V------++--V-----++--V---+
| Match | |Policy | |Policy| | Set || Policy ||Policy|
|Operator| |Variable| |Value | |Operator||Variable|| Value|
+--------+ +--------+ +------+ +--------++--------++------+
Figure 1: Overall model BNP IM structure
Network-Policy - contains sets of policies.
Policy-Set: Provides an ordered list of Policy Groups according to the priority and precedence of the rules. rules. it is inserted into the inheritance hierarchy above both Policy-Group and Policy-Rule.
Policy-Group: Defines the basic network policy Group model which combines the a list of Policy-Rules.
Policy Rule: Represents the semantics of “If Condition then Action”.
In the Condition model, the ‘Match’ operator is usually implied while in the action model, the ‘Set' operator is explicitly used.
Policy-Sets, Policy-Groups, and Policy-Rules have basic functionality (Policy-Basic IM) plus extensions defined by specific Information Models such as:
I2RS Client-Agents Information Models MAY support only the Policy-Basic IM, or MAY support any additional specific information models.
Each level of the Policy hierarchy (Policy-Set, Policy-Group, and Policy-Rules have both a read and write scope
The Policy-Set structure has the following elements:
Figure 2 - Policy Set RBNF <Network_policy> ::= (<Policy_Set> ...) <Policy-Set> ::= <Policy-Set-Name> <Policy_Group_list> <PG_Priority< <PG_precedence> <Policy-Group_list> ::= (<Policy-Group> ...)
In order to provide hierarchical policy definition and associate policy rule with other constraint, the basic policy group model needs to be defined. The corresponding extensions are introduced in a component, whose structure is informally depicted in the following diagram.
Figure 2 - Policy Group
+---------------------------------------+ (optional)
| Policy Group |....
+---------------------------------------+ :
* * * * ^ :
| | | :....:
| | | | |
| | | | |
| | | | |
+--------+ +----+ +-----------+ +------------------+
|Identity| |Role| |Group order| | Policy Rule |
+--------+ +----+ +---+--+---+| +------------------+
* * * * * *
| | | | |
+--+ | - +---------+ +-------+ | +-+-------+
| | | |priority | |policy | | |mandatory|
| | +---------+ |order | | +---------+
+----+---+ ++----+ |-+----------+ +-------+ | +-------+
|Resource| |Scope| |-|precedence| | ----+-+ Name +
+--------+ +-----+ | +----------+ | +--------+ | +-------+
* * | +----------+ |-|priority| | +-------+
| | |-|preference| | +--------+ +-|enabled|
| | | +----------+ | +----------+ +-------+
| | | +----------+ |-|precedence|
| | |-| combine | | +----------+
| | | +----------+ | +----------+
| | | +----------+ |-|preference|
| | |-|refcnt | | +----------+
| | +----------+ | +----------+
+-----++-----+ +-| combine |
| Read||Write| | +----------+
|Scope||Scope| | +----------+
+-----++-----+ |-| refcnt |
+----------+
The basic information model works as follows: Within the policy group information model, hierarchy is used to model context or scope for the sub-rule actions. A policy group contains Identity, role, and group ordering information. The ordering is the variables priority, precedence, preference, combination operators (AND plus OR), and reference count (refcnt) for the policy group. The same ordering information is kept at the rule level.
The elements of the Policy Group information model are as follows:
Figure 4 - Policy-Group RBNF
<Policy-Group> ::= <Policy-Group_Identity>
<Policy-Group_Roles>
<Policy-Group_order>
(<Policy-Rule* list>)
[<Supporting-Policy-Group_list>]
[<Policy-Group-Extension>]
<Policy-Group-Roles> ::= (<Policy-Group-Role> ...)
<Policy-Group-Role> ::=<Node-RESOURCES> | <Policy-Group-Scope>
<Node-RESOURCES> ::= [<I2RS_AGENT_RESOURCE>]
<Policy-Group-Scope> ::= (<READ_SCOPE> <Policy-Group_Read_Scope>)
| (<WRITE_SCOPE> <Policy-Group_Write_Scope>)
<Policy-Group_Identity> ::= STRING;
<Policy-Group-Order> ::= <Policy-Group-Priority>
<Policy-Group_precedence>
<Policy-Group_preference>
<Policy-Group_combine>
<Policy-Group_refcnt>
<Policy-Group-priority> ::= <PRIORITY>
<Policy-Group-precedence> ::= <PRECEDENCE>
<Policy-Group-preference> ::= <PREFERENCE>
<Policy-Group_Combine> ::= <COMBO-OPERATORS>
<Policy-Group-refcnt> ::= <REFCNT>
<PRIORITY> :: = INTEGER;
<PRECEDENCE> :: = INTEGER:
<PREFERENCE> ::= INTEGER;
<COMBO-OPERATORS> :: = [AND] | OR| NULL;
<REFCNT> :: = INTEGER;
<Policy-Rule-list> ::= <Policy-Rule>*
[Xpath in Yang may or may not be able to replace the definitions below ]
<Policy-Group_Read_Scope> ::= <Policy-Group_Read_Scope_Type>
[<RIB-IM_READ_list>]
[<BGP-IM-READ_list>]
<Policy-Group_Read_Scope_Type> ::= <RIB-IM_READ_SCOPE_TYPE>
| <BGP-IM_READ_SCOPE_TYPE>
<Policy-Group_Write_Scope> ::= <Policy-Group_Write_Scope_Type>
[<RIB-IM_WRITE_list>]
[<BGP-IM-WRITE_list>]
<Policy-Group_Write_Scope_Type> ::= <RIB-IM_WRITE_SCOPE_TYPE>
| <BGP-IM_WRITE_SCOPE_TYPE>
<Supporting-Policy-Group> ::= <SUPPORT-POLICY-GROUP> (
<Policy-Group> ...)
<Policy-Group-Extension> ::= ... /* Vendor Specific Policy */
A more formal depiction in RBNF format follows below
Figure 5 - Policy Rule
+----------------+
| Policy Rule |
+----------------+
* *
| |
| |
+---------+ +--------+
...>|Condition|<.......| Action |<...
: +---------+<.......+--------+ :
: : * * : :
:..... | : :... :
| :
+--------+...........:
|Operator|
+--------+
The following diagram contains an informal graphical depiction of the main elements of the information model:
Roughly speaking, the basic information model works as follows: A policy rule must identity, match conditions and actions; and it may contain policy rule ordering and status information. A operator connects variable and value in the action or condition. Condition can map onto and be supported by other condition, while action can map onto and be supported by other actions.
The elements of the Policy Rule information model are as follows:
Figure 6 Policy Rule RBNF
<Policy-Rule> ::= [<Policy-Rule-identity>]
[<Policy-Rule-Order>]
[<Policy-Rule-Scope]
[<Policy-Rule-Status>]
<Policy-Match>
<Policy-Condition>
[<Policy-Rule_rule_extensions>]
<Policy-Rule-Order> ::= <Policy-Group-Priority>
<Policy-Group_precedence>
<Policy-Group_preference>
<Policy-Group_combine>
<Policy-Group_refcnt>
<Policy-Rule-Status> ::= [<Policy-Rule-Enable>]
[<Policy-Rule-Mandatory>]
<Policy-Rule-identity> ::= string;
<Policy-Rule-Priority> ::= <PRIORITY>
<Policy-Rule-precedence> ::= <PRECEDENCE>
<Policy-Rule-preference> ::= <PREFERENCE>
<Policy-Rule-Combine> ::= <COMBO_OPERATORS>
<Policy-Rule-refcnt> ::=<REFCNT>
<Policy-Enable> ::= Boolean;
<Policy-Mandatory> ::=Boolean;
<Policy-Rule_Condition> ::= <Policy-Rule_Match_node>
(<Policy-Rule_Match_value> ...)
[<Policy-Rule_mode>]
[<Policy-Rule_Match_Operator>]
[<Policy-Rule_Condition_extension>]
<Policy-Rule_Match_node> ::= [<Policy-Rule_Match_Node_BNP-IM>]
| [<Policy-Rule_Match_node_external]
<Policy-Rule_Match_value> ::= [<Policy-Rule_Match_Value_BNP-IM>]
| [<Policy-Rule_Match_Value_external]
<Policy-Rule_mode> ::= PERMIT | DENY ;
<Policy-Rule_Match_operator_external> ::=
[<Policy-Rule_Match_Operator_BNP-IM>]
| [<Policy-Rule_Match_Operator_external]
<Policy-Rule-action> ::= <Policy-Rule_Action_variable>
<Policy-Rule_Action_value>
<Policy-Rule_Set-Operator>
[<Policy-Rule_action-extension> ]
<Policy-Rule_Security-Model> ::= <First-Matching>
|<All-Matching>]
<Policy-Rule_rule_extension> ::=
<I2RS-LC-policy_rule_extensions>
<Policy-Rule-action> ::= <Policy-Rule_Action_variable>
<Policy-Rule_Action_value>
<Policy-Rule_Set-Operator>
[<Policy-Rule_action-extension> ]
<Policy-Rule_Action_variable> ::= <Policy-Rule_Action_var>
(<Policy-Rule_Action_value> ...)
[<Policy-Rule_Set_Operator>]
[<Policy-Rule_Action_extension>]
<Policy-Rule_Action_var> ::= [<Policy-Rule_Action_Vars_BNP-IM>]
| [<Policy-Rule_Action_external>]
<Policy-Rule_Action_value> ::= [<Policy-Rule_Action_Vars_BNP-IM>]
| [<Policy-Rule_Action_external>]
<Policy-Rule_Set_Operator> ::= [<Policy-Rule_Set_Operator_BNP-IM>]
| [<Policy-Rule_Set_Operator_external>]
<Policy-Rule-action-extension> ::=
[<Policy-Rule_act_ext_BNP-IM>]
| [<Policy-Rule_act_ext_external>]
<Policy-Rule-Match-Operator-Policy-IM> ::= <IS-SET-MEMBER'>
|<IN-INTEGER-RANGE>
|<IP-ADDRESS-AS-RESOLVED-BY-DNS>
|<Policy_IM-Match-Operator-extension>
<Policy-Rule_condition_extension> ::=
<Policy_Rule_condition_ext-BNP-IM>
[<Policy-Rule_Condition_ext_external>]
! Policy Rule scope maps to ROLE Read/Write Concept
! This concept is under revision (see i2rs-security-draft)
! It is intended to restrict even policy to a portion of the
! Routing tree. Whether this makes policy simpler or more
! complex is the question.
<Policy-Rule_Scope> ::= (<READ_SCOPE>
<Policy-Rule_Read_scope>)
| (<WRITE_SCOPE>
<Policy-Rule_Write_scope>)
<Policy-Rule_Read_scope> ::= ((<BNP_READ_SCOPE_TYPE>
<BNP_READ_SCOPE_list>) ...)
| [<Policy-Rule_Read_Scope_External>]
<Policy-Rule_Write_scope> ::= ((<BNP_WRITE_SCOPE_TYPE>
<BNP_WRITE_SCOPE_list>)...)
[<Policy-Rule_Write_Scope_External>]
/* these scopes besides RIB IM are defined in each IM */
<PR_Read_Scope_RIB_IM> ::=<RIB-IM_READ_SCOPE_TYPE>
<RIB-IM_READ_list>
<PR_Read_Scope_RIB_IM> ::=<RIB-IM_READ_SCOPE_TYPE>
<RIB-IM_READ_list>
<RIB-IM_READ_list> ::= [<RIB-IM-Tree-Match> ...]
<RIB-IM_WRITE_list> ::= [<RIB-IM-Tree-Match> ...]
<RIB-IM-Tree-Match> ::= <RIB-IM-Match-routing-instance>
<RIB-IM-Match-interface-list>
<RIM-IM-Match-rib_list>
<RIB-IM-match-route-list>
/* extensions to other IM */
/* External Read and Write Scope */
<Policy-Rule_Read_Scope_External> ::=
[<PR_Read_Scope_RIB_IM>]
[<PR_Read_Scope_BGP_IM>]
[<PR_Read_Scope_PBR_IM>]
[<PR_Read_Scope_I2RSLC_IM>]
[<PR_Read_Scope_STopo_IM>]
[<PR_Read_Scope_SFC-Policy_IM>]
<Policy-Rule_Write_Scope_External> ::=
[<PR_Write_Scope_RIB_IM>]
[<PR_Write_Scope_BGP_IM>]
[<PR_WriteScope_PBR_IM>]
[<PR_Read_Scope_I2RSLC_IM>]
[<PR_Read_Scope_STopo_IM>]
[<PR_Read_Scope_SFC-PolicyIM>]
/* External Rule Conditionals */
<Policy-Rule_Match_node_external> ::=
[<Policy-Rule_Match_Node_RIB-IM>]
| [<Policy-Rule_Match_Node_PBR-IM>]
| [<Policy-Rule_match_Node_I2RSLC-IM>]
| [<Policy-Rule_Match_Node_BGP-IM>]
| [<Policy-Rule_Match_Node_STopo-IM>]
| [<Policy-Rule_Match_Node_SFC-Policy-IM>]
<Policy-Rule_Match_Value_external> ::=
[<Policy-Rule_Match_Value_RIB-IM>]
| [<Policy-Rule_Match_Value_PBR-IM>]
| [<Policy-Rule_Match_Value_I2RSLC-IM>]
| [<Policy-Rule_Match_Value_BGP-IM>]
| [<Policy-Rule_Match_Value_STopo-IM>]
| [<Policy-Rule_Match_Value_SFC-Policy-IM>]
<Policy-Rule_Match_operator_external> ::=
[<Policy-Rule_Match_Operator_RIB-IM>]
| [<Policy-Rule_Match_Operator_PBR-IM>]
| [<Policy-Rule_Match_Operator_I2RSLC-IM>]
| [<Policy-Rule_Match_Operator_BGP-IM>]
| [<Policy-Rule_Match_Operator_STopo-IM>]
| [<Policy-Rule_Match_Operator_SFC-Policy-IM>]
<Policy-Rule_Action_value_external> ::=
[<Policy-Rule_Action_Values_RIB-IM>]
| [<Policy-Rule_Action_Values_PBR-IM>]
| [<Policy-Rule_Match_Operator_I2RSLC-IM>]
| [<Policy-Rule_Action_Values_BGP-IM>]
| [<Policy-Rule_Set_Operator_STopo-IM>]
| [<Policy-Rule_Set_Operator_SFC-Policy-IM>]
<Policy-Rule_Set_Operator_external> ::=
[<Policy-Rule_Set_Operator_RIB-IM>]
| [<Policy-Rule_Set_Operator_PBR-IM>]
| [<Policy-Rule_Match_Operator_I2RSLC-IM>]
| [<Policy-Rule_Set_Operator_RIB-IM>]
| [<Policy-Rule_Set_Operator_BGP-IM>]
| [<Policy-Rule_Set_Operator_STopo-IM>]
| [<Policy-Rule_Set_Operator_SFC-Policy-IM>]
<Policy-Rule_act_ext_external> ::=
[<Policy-Rule_extension_RIB-IM>]
| [<Policy-Rule_act_ext_PBR-IM>]
| [<Policy-Rule_act_ext_I2RSLC-IM>]
| [<Policy-Rule_act_ext_RIB-IM>]
| [<Policy-Rule_act_ext_BGP-IM>]
| [<Policy-Rule_act_ext_STopo-IM>]
| [<Policy-Rule_act_ext_SFC-Policy-IM>]
| [<I2RS_Vendor-Rule_act_ext>]/* other I2RS IM */
The information model for the Network-policy component is more formally shown in RBNF below:
This section specifies the network policy information model in Routing Backus-Naur Form (RBNF, [RFC5511]). It also provides diagrams of the main entities of which the information model is comprised.
<basic-network_policy_in> ::= (<policy-set> ...) <basic-network_policy_out> ::= (<policy-set> ...) <network-policy_rules_list> ::= (<policy-rule>...)
Figure 11 - RIB Information Model Extensions
<RIB-IM_READ_list> ::= [<RIB-IM-Tree-Match ...]
<RIB-IM_WRITE_list> ::= [<RIB-IM-Tree-Match ...]
<RIB-IM-Tree-Match> ::= <RIB-IM-Match-routing-instance>
<RIB-IM-Match-interface-list>
<RIM-IM-Match-rib_list>
<RIB-IM-match-route-list;
/* BGP Info Module Tree Match */
<BGP-IM_READ_list> ::= [<BGP-IM-Tree-Match ...]
<BGP-IM_WRITE_list> ::= [<BGP-IM-Tree-Match ...]
<BGP-IM-Tree-Match> ::= <BGP-IM-Tree-Match-protocol-instance>
<BGP-IM-Match-Protocol-instance> ::= (<BGP_protocol> ...)
<pbr_rib> ::= <bgp_route_list>
<bgp_route_list> ::= (<bgp_route> ...)
<bgp_route> ::= <BGP_ROUTE_TYPE>
<bgp_route_prefix>
<bgp_attribute_list>
<bgp_route_create>
<bgp_rt_state_info>
<basic-network_policy_in> ::= (<policy-set> ...)
<basic-network_policy_out> ::= (<policy-set> ...)
<network-policy_rules_list> ::= (<policy-rule>...)
Figure 12 - BGP Information Model Extensions <BGP-IM_READ_list> ::= [<BGP-IM-Tree-Match ...] <BGP-IM_WRITE_list> ::= [<BGP-IM-Tree-Match ...] <BGP-IM-Tree-Match> ::= <BGP-IM-Tree-Match-protocol-instance> <BGP-IM-Match-Protocol-instance> ::= (<BGP_protocol> ...)
Figure 13 - SFC Topology Information Model Extensions /* what part of the STopo Model can access */ <STopo-IM_READ_list> ::= [<STopo-IM-Tree-Match ...] <STopo-IM_WRITE_list> ::= [<STopo-IM-Tree-Match ...] <STopo-IM-Tree-Match> ::= <STopo-IM-Tree-Match-protocol-instance> <STopo-IM-Match-Protocol-instance> ::= (<STopo_protocol> ...)
Figure 14 - Traffic Steering Information Model Extensions /* what part of the STopo Model can access */ <SFC-Policy-IM_READ_list> ::= [<SF-Policy-IM-Tree-Match ...] <SFC-Policy-IM_WRITE_list> ::= [<SF-Policy-IM-Tree-Match ...] <SFC-Policy-IM-Tree-Match> ::= <SF-Policy-IM-Tree-Match-protocol-instance> <SFC-Policy-IM-Match-Protocol-instance> ::= <SF_instance_list>
This draft includes no request to IANA.
TBD