Subject: RE: [midcom] Terminology discussion - status

From: "Christian Huitema" <[email-masked]>
Date: Mon, 10 Sep 2001 10:43:26 -0700

We are missing something like a "ruleset type" that defines the type of
rule and action being considered; we may want to just focus on the
"5-tuple", but having explicit typing will provide the extensibility
that some required. By the way, ruleset is kind of hideous. I would
prefer to replace all occurrences of ruleset by pinhole...

> Filter Spec
>     Packet classifier (matching) information that identifies a set of
> packets to be treated a certain way by a middlebox.

This is fine.

> Action Spec
>     Description of the middlebox treatment/service to be applied to a
> set of
> packets.

I think that "action spec" is too restrictive. You want something like
"attributes." Consider as a possible attribute the identity of the agent
who created the ruleset; this is a useful parameter for access control,
but it definitely does not define an "action."

> Ruleset
>     The combination of one or more filter specs and one or more action
> specs.  Packets matching the filter spec(s) are to be treated as
> specified
> by the  associated action spec(s).  The ruleset may also contain
> auxilliary
> information such as timeout values, owning agent, etc.

Should add the "ruleset type" to the list.

-- Christian Huitema

_______________________________________________
midcom mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/midcom

---

From: Scott Brim <[email-masked]>
Date: Mon, 10 Sep 2001 14:48:35 -0400

> but it definitely does not define an "action."

Rulesets are installed as a unit.  Attributes belong to the ruleset, not
to a particular rule which came as part of it.

> Should add the "ruleset type" to the list.

Where would you use this?  There is only one ruleset type that I can
think of, which is a group of at least one filter spec and at least one
action spec.  Are you saying, for example, you would want a "pinhole"
ruleset type?  That would be a ruleset with a pinhole action rule.