Subject: RE: [midcom] Re: Need to close too (was: Topology considerations documents)

From: "Christian Huitema" <[email-masked]>
Date: Thu, 13 Sep 2001 14:34:58 -0700

OK, there is a confusion in my initial phrasing. Try this:

R86: It should possible to define rulesets that contain a more specific
filter than an overlapping ruleset, and a different set of attributes.
This should allow Midcom agent to request that a subset of the traffic
that would be allowed by the overlapping ruleset be specifically
disallowed. 

Reasoning: this is required for rapid response to intrusion detection.

To answer Mark question, yes I expect that "when the filters of two
rulesets overlap, the middlebox only executes the actions specified by
the most specific ruleset."

-- Christian Huitema

> -----Original Message-----
> From: Mark Duffy [mailto:[email-masked]]
> Sent: Thursday, September 13, 2001 12:42 PM
> To: Christian Huitema; Scott Brim; [email-masked]
> Subject: RE: [midcom] Re: Need to close too (was: Topology
> considerations documents)
> 
> At 12:15 PM 9/13/01 -0700, Christian Huitema wrote:
> >Proposed requirement R86 (or whatever is the number):
> >
> >R86: It should possible to define specific filters that are more
> >restrictive than an overlapping generic filter, including filters
> that
> >would prevent traffic for a specific set of IP addresses and
> transport
> >parameters even if that traffic was authorized by an overlapping
> >"wildcard" filter.
> >
> >Reasoning: this is required for rapid response to intrusion
> detection.
> >
> 
> Sounds good to me.  However, I have a few questions on details:
> 
> 1. Does "more restrictive" here refer to having a more specific (less
> wildcarded) classifier rule, or does it refer to the disposition rule
> being
> less likely to allow the packet through?  Can we clarify the wording?
> 
> 2. Does the above R86 imply that the agent must be able to tell the
> middlebox that this "new" rule should be matched to packets with a
> higher
> precedence then the "older", more highly wildcarded rule?  Or do you
> believe a ridgidly defined canonical ordering system can cover that
> need?
> 
> - Thanks, Mark
> 
> 
> 
> _______________________________________________
> midcom mailing list
> [email-masked]
> http://www1.ietf.org/mailman/listinfo/midcom

_______________________________________________
midcom mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/midcom

---

From: Scott Brim <[email-masked]>
Date: Thu, 13 Sep 2001 18:00:58 -0400

> Reasoning: this is required for rapid response to intrusion detection.

Amended.