Subject: RE: [midcom] resource/ruleset ownership (R3b, R59 & R79)

From: "Christian Huitema" <[email-masked]>
Date: Wed, 26 Sep 2001 09:10:14 -0700

> -----Original Message-----
> From: Bob Penfield [mailto:[email-masked]] 
> Sent: Wednesday, September 26, 2001 8:10 AM
> To: midcom mail-list
> Subject: [midcom] resource/ruleset ownership (R3b, R59 & R79)
> 
> 
> I have some questions/comments on these items relative to ownership.
> 
> R3b: The Midcom protocol MUST support multiple agents manipulating
>      the same middlebox resource.
> 
> R59: The MIDCOM Protocol must allow the ownership of a requested flow
>      to be transferred from one MIDCOM Agent to another.
> 
> R79: The midcom protocol must not preclude multiple authorized agents
>      from working on the same ruleset.
> 
> First, R3b and R79 seem to be talking about the same thing. 
> My question is:
> based on our current definition of ruleset, what other 
> resources would a
> midcom agent manipulate? If rulesets (and their component 
> parts) are the
> only thing that an agent is allowed to manipulate, then we should pick
> either R3b (s/resource/ruleset/) or R79.
> 
> Given that we want to allow (or at least not preclude) multiple agents
> manipulating the same ruleset (e.g. one agent creates it and 
> another deletes
> it), the issue is how does the middlebox decide that a given agent is
> authorized to manipulate a given ruleset?
> 
> I do not like R59 because it requires that the application 
> (via the midcom
> agent) explicitly handoff the "ownership" to another. This is 
> particularly
> problematic when you have redundancy in the application. If a 
> given instance
> of the application (and its midcom agent that created the 
> ruleset) dies, the
> midcom agent associated with a redundant instance of the 
> application needs
> to be able to delete the ruleset when the application 
> determines that the
> ruleset is no longer required (e.g. when a SIP session ends, 
> the ruleset
> allowing the RTP flows needs to be removed).

You are correct. We should scratch R59, and in fact scratch any
reference to "ownership of flows." In fact, we could just keep a
slightly more explicit version of R79:

R79: The midcom protocol must not preclude multiple authorized agents
     from working on the same ruleset, subject to access control rules
     defined by the administrator of the middlebox.

A possible implementation is to have a ruleset access control similar to
file access control, with creators, groups, superusers and the like.
There is no need for the wording in R59 about ownership of flows.

-- Christian Huitema

_______________________________________________
midcom mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/midcom