Subject: [midcom] R79/R80 - current status

From: Melinda Shore <[email-masked]>
Date: Thu, 30 Aug 2001 12:36:33 -0400

As things currently stand, there's consensus to delete R79.
There's a proposal to replace the text in R80 with the following:

"It must be possible to deterministically predict the
behavior the firewall in the presence of overlapping rules."

Right now there's no specific dissent (several people agree
that R80 should be deleted but haven't addressed replacement
text), so if you object please speak up.

Melinda

_______________________________________________
midcom mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/midcom

---

From: Abdallah Rayhan <[email-masked]>
Date: Thu, 30 Aug 2001 13:07:23 -0400 (EDT)

> behavior the firewall in the presence of overlapping rules."
 
This statement defines the behavior of the firewall instead
of the midcom protocol. I propose the following text instead:

"It is possible for descriptors, defining filtering and/or NAT 
rules, to overlap when requests from the same (various) agent(s) 
are formulated. It SHOULD be possible to deterministically
discern the outcome of processing the new descriptors in 
conjunction with what previously being accommodated by the 
middlebox being delete, add or modify request operation." 

I am using "SHOULD" because it is possible to have a stupid 
request that does not make sense in the context of application
or the request. Otherwise, reject the request.

regards
Abdallah

_______________________________________________________
Do You Yahoo!?
Get your free @yahoo.ca address at http://mail.yahoo.ca

---

From: Keith Moore <[email-masked]>
Date: Thu, 30 Aug 2001 12:59:46 -0400

> text), so if you object please speak up.

this might seem picky, but it seems like you want to be more specific.

in particular, seems like you want to be able to predict the behavior of 
the firewall entirely by looking at the rules, without having to know any
specifics about the firewall implementation.

Keith

---

From: Scott Brim <[email-masked]>
Date: Thu, 30 Aug 2001 13:10:25 -0400

> As things currently stand, there's consensus to delete R79.

And there will be some non-fatal response to an attempt to install a
duplicate ruleset.  Could someone please provide the replacement
requirement saying so?

> text), so if you object please speak up.

OK with me.

..Scott

---

From: Scott Brim <[email-masked]>
Date: Thu, 30 Aug 2001 13:40:27 -0400

> or the request. Otherwise, reject the request.

This confuses me.  I understand the short version (and I think it is
about the protocol -- since what we're putting a requirement on is
predictability of the result of a protocol exchange).  Your version is
long to start with, introduces terms we don't have clear definitions for
(e.g. "descriptor"), uses SHOULD where I really think a MUST is required
(any stupid request should be trashed -- only an acceptable overlapping
rule is relevant) ... and then I get lost in the uses of "being" near
the end.  Did you leave a couple of words out?

..Scott