Subject: [midcom] R86

From: "Christian Huitema" <[email-masked]>
Date: Thu, 11 Oct 2001 17:27:59 -0700

> -----Original Message-----
> From: Mark Duffy [mailto:[email-masked]]
> Sent: Thursday, October 11, 2001 4:22 PM
> To: Scott Brim; midcom
> Subject: Re: [midcom] Thought you'd want to know
> 
> At 06:01 PM 10/11/01 -0400, Scott Brim wrote:
> >On Thu, Oct 11, 2001 04:36:11PM -0400, Melinda Shore allegedly wrote:
> >> We are down to six (give or take my sloppy counting) unresolved
> >> requirements bullets.  We'll get these wrapped up ASAP.
> >
> >My opinions on the remaining ones ...
> >
> >   R86: It should possible to define rulesets that contain a more
> >        specific filter than an overlapping ruleset, and a different
> set
> >        of attributes.  This should allow Midcom agent to request
> that a
> >        subset of the traffic that would be allowed by the
> overlapping
> >        ruleset be specifically disallowed.
> >
> >        Reasoning: this is required for rapid response to intrusion
> >        detection.
> >
> >Accept.
> 
> Yes, accept.  But terminology needs to be updated.  Here is proposed
> wording (I also changed the bit about 'allowing' traffic to
> 'affecting'
> traffic, to be less firewall-centric):
> 
>    R86: It should be possible to define rulesets which contain filter
>         spec(s) that overlap with those of other rulesets.  This
> should
>         allow a Midcom agent to install a ruleset affecting only a
>         subset of the traffic that would be affected by the
> overlapping
>         ruleset.

Uh, no. The terminology was actually carefully chosen. We don't want
filters that "overlap"; we want a hierarchy of filters, otherwise the
whole protocol becomes undeterministic. I would say, accept the original
version.

-- Christian Huitema

_______________________________________________
midcom mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/midcom