Subject: [midcom] Re: R86

From: Mark Duffy <[email-masked]>
Date: Fri, 12 Oct 2001 10:43:09 -0400

>Uh, no. The terminology was actually carefully chosen. We don't want
>filters that "overlap"; we want a hierarchy of filters, otherwise the
>whole protocol becomes undeterministic. I would say, accept the original
>version.

Hi Christian.  I think I have the same interpretation of this requirement
as you do, but I don't see that the suggested wording change undermines it. 

Here is what and why I was attempting to change; I still think these are
desirable changes.  Can you say specifically where you diagree?

1.  Replace the word filter with filter spec.
2.  Clarify that it is really overlap of the the *filter spec* portions of
the rulesets that we are talking about.  (Overlap of the other components
of rulesets is irrelevant here, perhaps even meaningless.)

Those two objectives drove the change in the first sentence:

original:
  R86: It should possible to define rulesets that contain a more
       specific filter than an overlapping ruleset, and a different set
       of attributes. 

Mark's proposed changes:
  R86: It should be possible to define rulesets which contain filter
       spec(s) that overlap with those of other rulesets. 

As an added observation, it is implicit here that "other rulesets" may have
a "different set of attributes".

If "that overlap with" were changed back to "that are more specific than",
would that fix it in your mind?  I had been thinking that the the two had
to be synonymous here.  I was thinking in terms of address prefixes where
the only way one can overlap another is to be a more specific subset.
Thinking about it a little more now, that is obviously not the case for an
overall n-tuple filter spec.  In fact, as a practical matter, if there are
two filter specs and both have wildcards, and there is some overlap, I
don't think it is possible to determine which is "more specific", absent
some arbitrary rules for doing so.  (I know you have previously proposed
some such rules.)

3.  Remove the firewall-centricity in the concept of "allowing" traffic.
Replace it by the more general concept of "affecting" traffic.  Thus the
change in the 2nd sentence:

original:
  R86: This should allow Midcom agent to request that a
       subset of the traffic that would be allowed by the overlapping
       ruleset be specifically disallowed.

Mark's proposed changes:
  R86: This should
       allow a Midcom agent to install a ruleset affecting only a
       subset of the traffic that would be affected by the overlapping
       ruleset.

_______________________________________________
midcom mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/midcom