Subject: [midcom] RE: R86

From: "Christian Huitema" <[email-masked]>
Date: Fri, 12 Oct 2001 08:41:20 -0700

> 1.  Replace the word filter with filter spec.

No issue there.

>   R86: It should possible to define rulesets that contain a more
>        specific filter than an overlapping ruleset, and a different
> set
>        of attributes.
> 
> Mark's proposed changes:
>   R86: It should be possible to define rulesets which contain filter
>        spec(s) that overlap with those of other rulesets.
 
There is a difference between the restricted overlap mentioned in "more
specific" and the general overlap induced by the second phrasing. So,
the first phrase should definitely be: "It should possible to define
rulesets that contain a more specific filter spec than an overlapping
ruleset, and specify a different set of actions."
 
> As an added observation, it is implicit here that "other rulesets" may
> have a "different set of attributes".

Maybe, but there is also no harm in being explicit.

> 3.  Remove the firewall-centricity in the concept of "allowing"
> traffic.
> Replace it by the more general concept of "affecting" traffic.  Thus
> the
> change in the 2nd sentence:
> 
> original:
>   R86: This should allow Midcom agent to request that a
>        subset of the traffic that would be allowed by the overlapping
>        ruleset be specifically disallowed.
> 
> Mark's proposed changes:
>   R86: This should
>        allow a Midcom agent to install a ruleset affecting only a
>        subset of the traffic that would be affected by the overlapping
>        ruleset.

The problem is that we actually need the firewall specific phrasing as
an example of application. After all, firewalls *are* our main concern.
Your second wording is too generic, and in fact is almost equivalent to
the "different actions" phrase. To quote Tom's message, "A key point
that came out a couple of messages ago is that it should be possible to
install actions for the subset which contradict those for the parent
set.  This should be included somehow."

So, to take into account everybody's input, I suggest the following:

R86: It should possible to define rulesets that contain a more specific
filter spec than an overlapping ruleset. This should allow agents to
request actions for the subset that contradict those of the overlapping
set. This should allow Midcom agent to request to a Midcom server
controlling a firewall function that a subset of the traffic that would
be allowed by the overlapping ruleset be specifically disallowed.

OK?

-- Christian Huitema

_______________________________________________
midcom mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/midcom