Subject: RE: [midcom] R79/80

From: "Christian Huitema" <[email-masked]>
Date: Wed, 29 Aug 2001 11:19:41 -0700

I believe we should certainly delete R79 -- it looks at a poor attempt
to specific way to solve the R23 requirement. A definitive possibility
is to have "intrinsic" rule identifiers such as:
	Internal IP, External IP, Protocol, Internal Port, External Port
Example of identifiers could be:
 (a) 10.0.0.2; 64.5.6.7; UDP; 3045; 7089
 (b) 10.0.0.2; *; UDP; 3045; *
 (c) *; 64.5.6.7; UDP; *; 7089
The beauty of any "intrinsic" identification is that there cannot be any
ambiguity about the removal of rules: if I remove "10.0.0.2; *; UDP;
3045; *" I remove rule (b), but I definitely leave rule (a) alone. This
removes any requirement for rule 79: if I attempt to remove "10.0.0.2;
*; UDP; 3045; *" and I am authorized, it is removed, and I need exactly
one transaction. The current R80 actually specifies the opposite of what
we want: when the most specific rule is removed, we just need to apply
the default behavior specified by the overlapping rule.

Indeed, some rules will overlap, which implies a rewriting of R80:
 
	R83: It must be possible to deterministically predict the
behavior
	of the firewall in the presence of overlapping rules.

I am tempted to add a requirement that "in the presence of overlapping
rules, the firewall must apply the most specific rules that matches the
filtered packet", but this requires that we define a global ordering
relation between rules. Take the three examples above. We can be easily
convinced that (a) is more specific than either (b) or (c), but what
about the relative order of (b) and (c)? Any convention there is going
to be arbitrary. If I had a choice, I would say that the rule is defined
by the ordered list
 <interior IP> <protocol> <interior port> <exterior IP> <exterior port>
which would rule that (b) is more specific than (c). But this is clearly
an arbitrary choice.

-- Christian Huitema 

> -----Original Message-----
> From: Melinda Shore [mailto:[email-masked]]
> Sent: Tuesday, August 28, 2001 12:16 PM
> To: [email-masked]
> Subject: [midcom] R79/80
> 
> Next question:
> 
> R79/80 - kill or keep?  It's related to the question of ownership
> but isn't the same.  R79 says:
> 
> "If a particular ruleset is created multiple times, it must be
> deleted the same number of times"
> 
> and R80 says:
> 
> "If two rulesets overlap, and one is deleted, the overlapping
> area must not be deleted until the other is deleted."
> 
> If we keep R80 we need to do something about defining "overlap."
> I believe that it's not currently addressed elsewhere in our
> documents.
> 
> Melinda
> 
> 
> 
> _______________________________________________
> midcom mailing list
> [email-masked]
> http://www1.ietf.org/mailman/listinfo/midcom

_______________________________________________
midcom mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/midcom

---

From: Eliot Lear <[email-masked]>
Date: Wed, 29 Aug 2001 11:26:59 -0700

What Christian wrote is fine with me.
--
Eliot Lear
[email-masked]

---

From: [email-masked]
Date: Wed, 29 Aug 2001 15:00:59 -0700 (PDT)

> 	of the firewall in the presence of overlapping rules.

I agree.  If you know how the firewall will act in the presence
of overlapping rules, you can have the agents and applications
behave in ways that can achieve specific desired results.  
			regards,
				Ted Hardie