Subject: RE: [midcom] Framework comments & suggestions

From: [email-masked]
Date: Wed, 1 Aug 2001 09:02:33 +0100

Hi,

> > >   "In the context of the MIDCOM Framework, the policy 
> > >    server does not assist a middlebox in the implementation 
> > >    of the services it provides or with resource authorization 
> > >    on the middlebox."
> > > 

This reads that the policy server does not assist a middlebox with resource
authorisation on the middlebox. 

1. I think this is incorrect, surely one of the very functions of the policy
server is to assist the middlebox in determining  which MIDCOM Agent can do
what? If not what precisely does it do?
2. I think this is well into the area of defining requirements (I recall a
lengthy discussion concerning the fact and broad agreement that the
requirements document was the place where the "what was required" issues
were documented).
3. I prefer the first sentence of section 2.9 in the 03 draft. I do not
think we should be embelishing this point further in this document - the
requirements need to be discussed and documented in the requirements
document and not here!

regards

Richard

_______________________________________________
midcom mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/midcom

---

From: "Bob Penfield" <[email-masked]>
Date: Wed, 1 Aug 2001 07:24:59 -0400

----- Original Message -----
From: <[email-masked]>
To: <[email-masked]>; <[email-masked]>; <[email-masked]>;
<[email-masked]>
Sent: Wednesday, August 01, 2001 4:02 AM
Subject: RE: [midcom] Framework comments & suggestions

> authorisation on the middlebox.

That is exactly what the original sentence said.

> what? If not what precisely does it do?

Within the context of MIDCOM, the policy server is used to determine which
MIDCOM agents can do what. What is out-of-scope of MIDCOM is authorization
of specific flows or functions. The problem with the original sentence was
that it made resource authorization via the policy server out-of-scope for
middleboxes period, which is what I felt over stepped the bounds of what
MIDCOM should be specifying. Specifically, I was thinking that the policy
server could define pre-configured pin-holes for the middlebox (certainly
out-of-scope of MIDCOM).

However, I do see your point that this language might be interpreted to
restrict the level to which the policy server can control MIDCOM requests.
For example, I might want to say agent X is allowed to open pin-holes for a
narrow set of addresses. I originally wanted the sentence removed as you do
(that is still my preference), but was willing to compromise on language
that did not restrict what the middlebox used the policy server outside the
context of MIDCOM.

> requirements document was the place where the "what was required" issues

Possibly, but certainly the framework document is the place to define what
is in scope and out of scope of MIDCOM.

---

From: Melinda Shore <[email-masked]>
Date: Wed, 01 Aug 2001 07:32:46 -0400

At 07:24 AM 8/1/01 -0400, Bob Penfield wrote:
>What is out-of-scope of MIDCOM is authorization
>of specific flows or functions. 

???  Why do you say that?

Melinda

---

From: "Bob Penfield" <[email-masked]>
Date: Wed, 1 Aug 2001 08:16:45 -0400

I guess that just reinforces your point that the text is ambiguous. I was
attempting to clarify what it said and obviously failed. So that leaves us
with the question of what was originally intended by "The Policy server does
not assist a middlebox in the implementation of the services it provides or
with resource authorization on the middlebox"

(-:bob

Robert F. Penfield
Chief Software Architect
Acme Packet, Inc.
130 New Boston Street
Woburn, MA 01801
[email-masked]

---

From: Melinda Shore <[email-masked]>
Date: Wed, 01 Aug 2001 08:27:05 -0400

>with resource authorization on the middlebox"

Right, that absolutely does need to be clarified.  But I don't
think it's correct to say that there's no policy involvement in
responses to requests.  Consider the lowly ACL.

Melinda

---

From: Scott Brim <[email-masked]>
Date: Wed, 1 Aug 2001 10:09:43 -0400

> with resource authorization on the middlebox"

There are two separate issues.  

The text about implementation of services means that the
middlebox-policyserver relationship is orthogonal to the middlebox-agent
relationship.  The policy server provides information to the middlebox,
but does not get involved in the services middleboxes provide to agents
(unlike, say, an OPES device, which would be in a similar position in a
diagram but would be very involved in services).  I don't think there's
any disagreement here.

The statement that policy servers don't get involved in resource
authorization is the contentious one, and as you know I think it's
not appropriate.

..Scott

---

From: "Bob Penfield" <[email-masked]>
Date: Wed, 1 Aug 2001 12:58:52 -0400

----- Original Message -----
From: "Scott Brim" <[email-masked]>
To: <[email-masked]>
Sent: Wednesday, August 01, 2001 10:09 AM
Subject: Re: [midcom] Framework comments & suggestions

> diagram but would be very involved in services).  I don't think there's

I still don't understand. Are you saying the policy server cannot tell the
middlebox which services a particular agent is allowed to use?

> authorization is the contentious one, and as you know I think it's

What does "resource authorization" mean?

My belief is that the information the policy server gives to the middlebox
will tell it which agents are allowed to talk to it, and which specific
functions a given agent is allowed to perform. This could even extend to the
middlebox consulting the policy server on a flow-by-flow or
request-by-request basis to determine if it should perform the operation
requested by the agent.

The only thing I have thought of so far in a policy server which might be
"out-of-scope" of MIDCOM would be information about statically configured
pin-holes or NATs.

Can you give some examples of the kinds of things you don't want the policy
server to do?

(-:bob

---

From: Scott Brim <[email-masked]>
Date: Wed, 1 Aug 2001 16:13:32 -0400

See inline ...

> middlebox which services a particular agent is allowed to use?

Not at all.  Don't you love English?  The policy server can tell the
middlebox what a particular agent is allowed to do (both at registration
time and at transaction time, I believe).  However, the policy server,
in its specific role as a policy server, does not provide the services
or participate in the midcom protocol.  The middlebox does all of that.

AI suspect we're agreeing.  lternate text for this sentence was already
proposed, wasn't it?

> What does 'resource authorization' mean?

It means I'm reading too fast.  What it meant originally was the policy
server saying an agent is allowed to do.  I confounded that with the
policy server saying which particular requests are allowed.

> request-by-request basis to determine if it should perform the operation

Right.

> "out-of-scope" of MIDCOM would be information about statically configured

Well, the entire policy server protocol is out of scope -- the framework
draft is context, stating the expected existence of a policy server.

> Can you give some examples of the kinds of things you don't want the policy

Something which does NAT is not a policy server -- although it might be
in the same device.  The policy server does not deliver the services of
a middlebox.

..Scott