From majordomo@raleigh.ibm.com Thu Mar 1 03:26:16 2001 Received: from fwns2.raleigh.ibm.com (fwns2d.raleigh.ibm.com [204.146.167.236]) by ietf.org (8.9.1a/8.9.1a) with SMTP id DAA28211 for ; Thu, 1 Mar 2001 03:26:15 -0500 (EST) Received: from rtpmail02.raleigh.ibm.com (rtpmail02.raleigh.ibm.com [9.37.172.48]) by fwns2.raleigh.ibm.com (8.9.0/8.9.0/RTP-FW-1.2) with ESMTP id DAA35658; Thu, 1 Mar 2001 03:25:40 -0500 Received: from rtpaix11.raleigh.ibm.com (rtpaix11.raleigh.ibm.com [9.37.172.4]) by rtpmail02.raleigh.ibm.com (8.8.5/8.8.5/RTP-ral-1.1) with SMTP id DAA27886; Thu, 1 Mar 2001 03:25:40 -0500 Received: by rtpaix11.raleigh.ibm.com (AIX 4.1/UCB 5.64/4.03-RAL) id AA57752; Thu, 1 Mar 2001 02:35:28 -0500 Received: from rtpmail02.raleigh.ibm.com by rtpaix11.raleigh.ibm.com (AIX 4.1/UCB 5.64/4.03-RAL) id AA57628; Thu, 1 Mar 2001 02:35:20 -0500 Received: from fwns1.raleigh.ibm.com (fwns1.raleigh.ibm.com [9.37.0.3]) by rtpmail02.raleigh.ibm.com (8.8.5/8.8.5/RTP-ral-1.1) with ESMTP id CAA28968; Thu, 1 Mar 2001 02:35:13 -0500 Received: from cisco.com (csi-admin1.cisco.com [144.254.91.12]) by fwns1.raleigh.ibm.com (8.9.0/8.9.0/RTP-FW-1.2) with ESMTP id CAA06118; Thu, 1 Mar 2001 02:34:30 -0500 Received: from YRAMBERG-W2K.cisco.com (telaviv3-dhcp18.cisco.com [144.254.93.146]) by cisco.com (8.8.5-Cisco.2-SunOS.5.5.1.sun4/8.8.8) with ESMTP id JAA06583; Thu, 1 Mar 2001 09:33:26 +0200 (IST) Message-Id: <4.3.2.7.2.20010301093144.02709dc0@csi-admin1.cisco.com> X-Sender: yramberg@csi-admin1.cisco.com X-Mailer: QUALCOMM Windows Eudora Version 4.3.2 Date: Thu, 01 Mar 2001 09:34:23 +0200 To: "Andrea Westerinen" , "Lee Rafalow" , From: Yoram Ramberg Subject: Re: PolTerm - Re: PolicyRepository (Re: Preliminary results from PCIMe technical meeting, 1/24/01 - 1/26/01) In-Reply-To: References: <4.3.2.7.2.20010208100520.0271f7c0@csi-admin1.cisco.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Sender: policy-owner@raleigh.ibm.com Precedence: bulk Reply-To: Yoram Ramberg Thanx Andrea. I believe your quotes from POLTERM just underscore and accentuate the weakness of the current terminology. Shall we fix it while we still can? *Yoram At 09:39 PM 2/28/2001 -0800, Andrea Westerinen wrote: >The Policy Terminology I-D has begun to address this issue by at least >acknowledging it ... > >$ policy repository >(P) "Policy repository" can be defined from three perspectives: >- A specific data store that holds policy rules, their conditions and >actions, and related policy data. A database or directory would be an >example of such a store. >- A logical container representing the administrative scope and >naming of >policy rules, their conditions and actions, and related policy data. A "QoS >policy" domain would be an example of such a container. >- In [RFC3060], a more restrictive definition than the prior one >exists. A >PolicyRepository is a model abstraction representing an administratively >defined, logical container for reusable policy-related elements. > >Andrea > >-----Original Message----- >From: policy-owner@raleigh.ibm.com >[mailto:policy-owner@raleigh.ibm.com]On Behalf Of Yoram Ramberg >Sent: Thursday, February 08, 2001 12:20 AM >To: Lee Rafalow; policy@raleigh.ibm.com >Subject: PolTerm - Re: PolicyRepository (Re: Preliminary results from >PCIMe technical meeting, 1/24/01 - 1/26/01) > > >(finally we have a thread to talk about it and I can't be blamed for >starting it!) > >I admit that I've experienced some confusion in the way we use the term >'repository' to denote various things. Here's an attempt to organize this >somewhat: > >Policy repository: This term has been used mostly to refer to storage. It >has been synonymous at times with the term 'policy database'. > >Reusable-objects repository: This term has been used to refer to the >classes that model the collection(s) of objects that are "reusable", i.e., >can be managed centrally but referred to ("used") by other objects. An >example is a reusable condition used by many rules. > >Repository: Has also been used to refer to a directory (LDAP). This was >mostly used in schema documents but sipped sometime into info model docs as >well. > >To me the first two have been confusing and required me to do a double take >several times while reading (even text I myself had written!). In >particular this becomes tricky when reading through text such as this (not >a real example, just a possible one, but we have a couple of places that >almost read like this): > >"The object may be placed in the reusable-objects repository. Several >reusable-objects repositories may exist in the policy repository. The >administrator is free to locate the repositories anywhere within his/her >own organization repository as long as objects associated with >reusable-objects have access to the repositories where they >reside.'" Not easy, is it? > >While I learned to deal with it (after all, life has presented me with >greater challenges before and since), it would be nice to take this >opportunity and get it cleared out once and for all. > >I'll refrain from making a proposal for new terminology but I support this >effort for the reasons explained above. > >*Yoram > >At 11:17 AM 2/6/01 -0500, Lee Rafalow wrote: > >John, Thanks for your comments. I'm breaking responses into different > >threads for the different topics. I think this one is easy. > > > > > > 2.2.1. Changes to PolicyRepository > > > > > > > > Because of the potential for confusion with the Policy > > > > Framework component Policy Repository (from the four-box > > > > picture: Policy Management Tool, Policy Repository, PDP, > > > > PEP), it was determined that "PolicyRepository" is a bad > > > > name for the PCIM class representing a container of > > > > reusable policy elements. Thus the class PolicyRepository > > > > has been replaced with the class ReusablePolicyContainer. > > > > To accomplish this change, it was necessary to deprecate > > > > the PCIM class PolicyRepository and its three > > > associations, > > > > and replace them with a new class ReusablePolicyContainer > > > > and new associations. > > > > > > > > > I don't agree with this change. If this was so confusing, > > > why has the name withstood the examination of all for over a > > > year in this working group? Deprecating a class and its > > > associations to fix a problem that has not been complained > > > about is a bad decision. > > > > > > >I don't believe the name has withstood the examination. I've been confused > >about PolicyRepository since its inception and we've talked about this > >several times. I know others are also confused (including some people in > >your own company). One suggestion has been made that we change the name of > >the policy repository in the architecture drawing but that IS a policy > >repository by the English use of the words whereas the PolicyRepository > >class isn't a repository at all, it's an admindomain subclassed container > >object for reusable policy components. So, we concluded we ought to call >it > >that: ReusablePolicyContainer. If we were going to do something dramatic > >here, we'd change its superclass to a collection...but that hasn't been > >proposed. > > > >What's the harm in what we're proposing? Well, it does necessitate > >deprecating a few classes but this is the time to do that if we're going >to. > >PCIM is Proposed and we've been asked to reconcile PCIM and the other > >drafts. Is it essential to do this? No, I don't think so, but I do think > >we should. If there are any implementations out there that have carved >this > >in stone...we'll, we're deprecating its use, we're not deleting it. > > > >I think this is a red herring and not worth debating unless there's some > >reason for concern that I don't grok. But if someone thinks it's a >critical > >error to change the names of some classes in an Information Model, well, I > >yield...but tell me why it's critical. We're going to deprecate other > >things in the process, so it can't be that we can't change PCIM. > > > > > > As a separate change, the definition of a > > > > ReusablePolicyContainer was broadened, to allow it to > > > > contain any reusable policy elements. In PCIM, a > > > > PolicyRepository was allowed to contain only policy > > > > conditions and policy actions. > > > > > > > > > Huh? The definition of this class, from PCIM, is: > > > > > > "A class representing an administratively defined > > > container for reusable policy-related information." > > > > > > I've searched PCIM, and there is no text describing the > > > restriction you talk about above defined anywhere. This > > > *used* to be a restriction of QPIM, but that was removed a > > > long time ago. > > > > > > >The only associations that were defined in PCIM were associations for > >conditions and actions. The broadening that Bob referred to is that we're > >now explicitly extending the list in PCIMe rather than leaving it up to > >derived models to do so. Again, nothing to debate here either. > > > >Cheers, Lee From majordomo@raleigh.ibm.com Thu Mar 1 10:03:04 2001 Received: from fwns2.raleigh.ibm.com (fwns2d.raleigh.ibm.com [204.146.167.236]) by ietf.org (8.9.1a/8.9.1a) with SMTP id KAA06237 for ; Thu, 1 Mar 2001 10:02:39 -0500 (EST) Received: from rtpmail03.raleigh.ibm.com (rtpmail03.raleigh.ibm.com [9.37.172.47]) by fwns2.raleigh.ibm.com (8.9.0/8.9.0/RTP-FW-1.2) with ESMTP id KAA36464; Thu, 1 Mar 2001 10:02:01 -0500 Received: from rtpaix11.raleigh.ibm.com (rtpaix11.raleigh.ibm.com [9.37.172.4]) by rtpmail03.raleigh.ibm.com (8.8.5/8.8.5/RTP-ral-1.1) with SMTP id KAA42358; Thu, 1 Mar 2001 10:02:03 -0500 Received: by rtpaix11.raleigh.ibm.com (AIX 4.1/UCB 5.64/4.03-RAL) id AA58264; Thu, 1 Mar 2001 09:27:00 -0500 Received: from rtpmail03.raleigh.ibm.com by rtpaix11.raleigh.ibm.com (AIX 4.1/UCB 5.64/4.03-RAL) id AA58000; Thu, 1 Mar 2001 09:26:57 -0500 Received: from fwns2.raleigh.ibm.com (fwns2.raleigh.ibm.com [9.37.0.4]) by rtpmail03.raleigh.ibm.com (8.8.5/8.8.5/RTP-ral-1.1) with ESMTP id JAA29580 for ; Thu, 1 Mar 2001 09:27:00 -0500 Received: from ind.alcatel.com (postal.xylan.com [208.8.0.248]) by fwns2.raleigh.ibm.com (8.9.0/8.9.0/RTP-FW-1.2) with ESMTP id JAA36540 for ; Thu, 1 Mar 2001 09:26:55 -0500 Received: from mailhub.ind.alcatel.com (mailhub [198.206.181.70]) by ind.alcatel.com (8.9.3+Sun/8.9.1 (ind.alcatel.com 3.0 [OUT])) with ESMTP id GAA26685 for ; Thu, 1 Mar 2001 06:26:27 -0800 (PST) X-Origination-Site: Received: from newman.xylan.com (localhost [127.0.0.1]) by mailhub.ind.alcatel.com (8.9.3+Sun/8.9.3/(mailhub 3.2.4 [HUB])) with ESMTP id GAA28865 for ; Thu, 1 Mar 2001 06:26:12 -0800 (PST) X-Interscan: Passed Received: from ind.alcatel.com ([208.19.33.105]) by newman.xylan.com (Netscape Messaging Server 4.15) with ESMTP id G9IW2400.I7T; Thu, 1 Mar 2001 06:25:16 -0800 Message-Id: <3A9E5C37.544DAE7E@ind.alcatel.com> Date: Thu, 01 Mar 2001 09:27:03 -0500 From: "Michael See" Organization: Alcatel Internetworking X-Mailer: Mozilla 4.7 [en] (WinNT; U) X-Accept-Language: en Mime-Version: 1.0 To: Yoram Ramberg Cc: policy@raleigh.ibm.com Subject: Re: PolTerm - Re: PolicyRepository (Re: Preliminary resultsfrom PCIMe technical meeting, 1/24/01 - 1/26/01) References: <4.3.2.7.2.20010208100520.0271f7c0@csi-admin1.cisco.com> <4.3.2.7.2.20010301093144.02709dc0@csi-admin1.cisco.com> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: policy-owner@raleigh.ibm.com Precedence: bulk Reply-To: "Michael See" Content-Transfer-Encoding: 7bit Documenting the multiple uses of the term Policy Repository an a Terminology document seems like it should be sufficient. While I don't have a major problem with the suggested changes. It seems strange that we are considering depricating classes in an RFC that was just published. Mike Yoram Ramberg wrote: > Thanx Andrea. I believe your quotes from POLTERM just underscore and > accentuate the weakness of the current terminology. > Shall we fix it while we still can? > *Yoram > > At 09:39 PM 2/28/2001 -0800, Andrea Westerinen wrote: > >The Policy Terminology I-D has begun to address this issue by at least > >acknowledging it ... > > > >$ policy repository > >(P) "Policy repository" can be defined from three perspectives: > >- A specific data store that holds policy rules, their conditions and > >actions, and related policy data. A database or directory would be an > >example of such a store. > >- A logical container representing the administrative scope and > >naming of > >policy rules, their conditions and actions, and related policy data. A "QoS > >policy" domain would be an example of such a container. > >- In [RFC3060], a more restrictive definition than the prior one > >exists. A > >PolicyRepository is a model abstraction representing an administratively > >defined, logical container for reusable policy-related elements. > > > >Andrea > > > > From majordomo@raleigh.ibm.com Fri Mar 2 15:47:23 2001 Received: from fwns2.raleigh.ibm.com (fwns2d.raleigh.ibm.com [204.146.167.236]) by ietf.org (8.9.1a/8.9.1a) with SMTP id PAA17667 for ; Fri, 2 Mar 2001 15:46:04 -0500 (EST) Received: from rtpmail01.raleigh.ibm.com (rtpmail01.raleigh.ibm.com [9.37.172.24]) by fwns2.raleigh.ibm.com (8.9.0/8.9.0/RTP-FW-1.2) with ESMTP id PAA21264; Fri, 2 Mar 2001 15:43:23 -0500 Received: from rtpaix11.raleigh.ibm.com (rtpaix11.raleigh.ibm.com [9.37.172.4]) by rtpmail01.raleigh.ibm.com (8.8.5/8.8.5/RTP-ral-1.1) with SMTP id PAA32636; Fri, 2 Mar 2001 15:43:23 -0500 Received: by rtpaix11.raleigh.ibm.com (AIX 4.1/UCB 5.64/4.03-RAL) id AA59740; Fri, 2 Mar 2001 15:10:00 -0500 Received: from rtpmail02.raleigh.ibm.com by rtpaix11.raleigh.ibm.com (AIX 4.1/UCB 5.64/4.03-RAL) id AA59984; Fri, 2 Mar 2001 15:09:57 -0500 Received: from southrelay02.raleigh.ibm.com (southrelay02.raleigh.ibm.com [9.37.3.209]) by rtpmail02.raleigh.ibm.com (8.8.5/8.8.5/RTP-ral-1.1) with ESMTP id PAA26264 for ; Fri, 2 Mar 2001 15:10:02 -0500 Received: from d04nm200.raleigh.ibm.com (d04nm200.raleigh.ibm.com [9.67.228.37]) by southrelay02.raleigh.ibm.com (8.11.2/NCO v4.95) with ESMTP id f22K9wp41120 for ; Fri, 2 Mar 2001 15:09:58 -0500 Importance: Normal Subject: -09 version of PCLS available To: policy@raleigh.ibm.com X-Mailer: Lotus Notes Release 5.0.3 (Intl) 21 March 2000 Message-Id: From: "Robert Moore" Date: Fri, 2 Mar 2001 15:16:25 -0500 X-Mimetrack: Serialize by Router on D04NM200/04/M/IBM(Release 5.0.6 |December 14, 2000) at 03/02/2001 03:09:59 PM Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: policy-owner@raleigh.ibm.com Precedence: bulk Reply-To: "Robert Moore" I've just submitted PCLS-09 to the Internet-Drafts repository. Since it may take a while for it to appear there, I've also made it available at my usual alternate site: ftp://ftp.networking.ibm.com/pub/standards/aiw/misc/draft-ietf-policy-core-schema-09.txt I haven't seen a WG agenda for Minneapolis yet, but I'm sure we'll be touching on this draft at least briefly at some point in one of our two meetings. Regards, Bob Bob Moore IBM Networking Software +1-919-254-4436 remoore@us.ibm.com From majordomo@raleigh.ibm.com Mon Mar 5 21:47:55 2001 Received: from fwns1.raleigh.ibm.com (fwns1d.raleigh.ibm.com [204.146.167.235]) by ietf.org (8.9.1a/8.9.1a) with SMTP id VAA15567 for ; Mon, 5 Mar 2001 21:47:40 -0500 (EST) Received: from rtpmail03.raleigh.ibm.com (rtpmail03.raleigh.ibm.com [9.37.172.47]) by fwns1.raleigh.ibm.com (8.9.0/8.9.0/RTP-FW-1.2) with ESMTP id VAA06632; Mon, 5 Mar 2001 21:46:52 -0500 Received: from rtpaix11.raleigh.ibm.com (rtpaix11.raleigh.ibm.com [9.37.172.4]) by rtpmail03.raleigh.ibm.com (8.8.5/8.8.5/RTP-ral-1.1) with SMTP id VAA29194; Mon, 5 Mar 2001 21:46:53 -0500 Received: by rtpaix11.raleigh.ibm.com (AIX 4.1/UCB 5.64/4.03-RAL) id AA07514; Mon, 5 Mar 2001 21:13:02 -0500 Received: from rtpmail01.raleigh.ibm.com by rtpaix11.raleigh.ibm.com (AIX 4.1/UCB 5.64/4.03-RAL) id AA31570; Mon, 5 Mar 2001 21:12:59 -0500 Received: from fwns2.raleigh.ibm.com (fwns2.raleigh.ibm.com [9.37.0.4]) by rtpmail01.raleigh.ibm.com (8.8.5/8.8.5/RTP-ral-1.1) with ESMTP id VAA36814 for ; Mon, 5 Mar 2001 21:13:03 -0500 Received: from longmail2.lboard.com ([63.109.116.89]) by fwns2.raleigh.ibm.com (8.9.0/8.9.0/RTP-FW-1.2) with ESMTP id VAA24770 for ; Mon, 5 Mar 2001 21:12:59 -0500 Received: by longmail2.lboard.com with Internet Mail Service (5.5.2650.21) id ; Mon, 5 Mar 2001 21:12:58 -0500 Message-Id: From: Ed Ellesson To: "'policy@raleigh.ibm.com'" Subject: FW: Minneapolis Policy Agenda Date: Mon, 5 Mar 2001 21:12:50 -0500 Mime-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Content-Type: text/plain; charset="iso-8859-1" Sender: policy-owner@raleigh.ibm.com Precedence: bulk Reply-To: Ed Ellesson I'll try this again. I had to add myself back onto the mailing list, for some reason. -----Original Message----- From: Ed Ellesson Sent: Monday, March 05, 2001 12:50 PM To: 'policy@raleigh.ibm.com' Subject: Minneapolis Policy Agenda Hello, Policy Enthusiasts: The following is from the current agenda for the upcoming Minneapolis IETF. As you will see, we have two long agenda slots, adding up to 4 and one-half hours. We tried our best to avoid conflicts with related working groups, although we unfortunately were not able to avoid the LDAP Revision (ldapbis) working group, which I know a number of you were trying to attend. Please send your suggestions for agenda items. If there is a reason to deal with certain agenda items on a certain day, due to conflicts such as that noted above, please include that in your suggestions. Thanks, Ed and Joel MONDAY, March 19, 2001 1530-1730 Afternoon Sessions II APP impp Instant Messaging and Presence Protocol WG GEN midtax Middle Box Taxonomy BOF INT dhc Dynamic Host Configuration WG INT itrace ICMP Traceback WG OPS policy Policy Framework WG RTG pim Protocol Independent Multicast WG SEC secsh Secure Shell WG TSV nfsv4 Network File System Version 4 WG WEDNESDAY, March 21, 2001 0900-1130 Morning Sessions APP ipp Internet Printing Protocol WG APP ldapbis LDAP (v3) Revision WG GEN ccamp Common Control and Measurement Plane WG INT dhc Dynamic Host Configuration WG OPS policy Policy Framework WG SEC idwg Intrusion Detection Exchange Format WG TSV ips IP Storage WG TSV rmt Reliable Multicast Transport WG From majordomo@raleigh.ibm.com Fri Mar 9 18:44:42 2001 Received: from fwns2.raleigh.ibm.com (fwns2d.raleigh.ibm.com [204.146.167.236]) by ietf.org (8.9.1a/8.9.1a) with SMTP id SAA10756 for ; Fri, 9 Mar 2001 18:44:37 -0500 (EST) Received: from rtpmail02.raleigh.ibm.com (rtpmail02.raleigh.ibm.com [9.37.172.48]) by fwns2.raleigh.ibm.com (8.9.0/8.9.0/RTP-FW-1.2) with ESMTP id SAA19634; Fri, 9 Mar 2001 18:44:01 -0500 Received: from rtpaix11.raleigh.ibm.com (rtpaix11.raleigh.ibm.com [9.37.172.4]) by rtpmail02.raleigh.ibm.com (8.8.5/8.8.5/RTP-ral-1.1) with SMTP id SAA27832; Fri, 9 Mar 2001 18:44:02 -0500 Received: by rtpaix11.raleigh.ibm.com (AIX 4.1/UCB 5.64/4.03-RAL) id AA26518; Fri, 9 Mar 2001 17:19:47 -0500 Received: from rtpmail02.raleigh.ibm.com by rtpaix11.raleigh.ibm.com (AIX 4.1/UCB 5.64/4.03-RAL) id AA39566; Fri, 9 Mar 2001 17:19:44 -0500 Received: from fwns2.raleigh.ibm.com (fwns2.raleigh.ibm.com [9.37.0.4]) by rtpmail02.raleigh.ibm.com (8.8.5/8.8.5/RTP-ral-1.1) with ESMTP id RAA30602 for ; Fri, 9 Mar 2001 17:19:50 -0500 Received: from mx-relay2.treas.gov (mx-relay2.treas.gov [199.196.144.6]) by fwns2.raleigh.ibm.com (8.9.0/8.9.0/RTP-FW-1.2) with ESMTP id RAA21942 for ; Fri, 9 Mar 2001 17:19:47 -0500 Received: from tias4.treas.gov (tias-gw4.treas.gov [199.196.144.14]) by mx-relay2.treas.gov (8.9.1b+Sun/8.9.3) with SMTP id RAA04686 for ; Fri, 9 Mar 2001 17:19:47 -0500 (EST) Received: from mailhub.net.treas.gov by tias4.treas.gov via smtpd (for mx-relay.treas.gov [199.196.144.6]) with SMTP; 9 Mar 2001 22:19:47 UT Received: from mears.indy.cr.irs.gov (mailhub-3 [10.7.8.11]) by mailhub-3.net.treas.gov (8.9.3+Sun/8.9.3) with ESMTP id RAA01284 for ; Fri, 9 Mar 2001 17:16:58 -0500 (EST) Received: from parnelli.indy.cr.irs.gov (IDENT:lsbart35@localhost [127.0.0.1]) by mears.indy.cr.irs.gov (8.9.3/8.9.3) with ESMTP id RAA09040; Fri, 9 Mar 2001 17:19:45 -0500 Message-Id: <3AA95701.4206B0FE@parnelli.indy.cr.irs.gov> Date: Fri, 09 Mar 2001 17:19:45 -0500 From: "Larry S. Bartz" X-Mailer: Mozilla 4.72 [en] (X11; U; Linux 2.2.14-5.0smp i686) X-Accept-Language: en Mime-Version: 1.0 To: IETF Policy WG LIST Subject: PCIMe MATCHing and more Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: policy-owner@raleigh.ibm.com Precedence: bulk Reply-To: "Larry S. Bartz" Content-Transfer-Encoding: 7bit PCIMe's specification of context-sensitive inference of MATCHing semantics for policy conditions implies a potential that the correct inference might not be drawn. Unless the schema designer, the information infrastructure architect, and the policy-interpreting code designer/programmer are one-in-the-same, there's a lot of space between the rubber and the road. There may be a mechanism by which the MATCHing semantic can be made explicit. I'm suggesting such a mechanism, in which subtypes of policyConditionAuxClass are named for the particular comparison semantic they support. Use of these subtypes can constitute a semantic contract which binds the designer, implementor, and user to a model of usage which is unambiguous. As with policyCondition's MATCH semantic, policyAction's "set" semantic could be augmented. Unless one accepts the limitation of a simple assignment operation, "set" requires context-sensitive inference, just as condition's MATCH does. There may be a mechanism by which the "set" semantic of policyAction can be made explicit. I'm suggesting such a mechanism, in which subtypes of policyActionAuxClass are named for the particular assignment operation they support. Use of these subtypes can constitute a semantic contract which binds the designer, implementor, and user to a model of usage which is unambiguous. In section 5.14, PCIMe invents syntaxes for complex expressions of several types of value criteria. These inventions will require implementors to likewise invent corresponding custom code. If the MATCHing semantics of conditions are made explicit, some of the syntactical constructs of PCIMe 5.14 are not necessary. For example, expresssions of value ranges can be accomplished by CNF'd granular policy conditions of the explicit types described here. There may yet be cases in which combinations of granular conditions cannot suffice, even when augmented by PCIM's CNF, DNF, and negation facilities. These cases might inspire the invention of syntax, semantics, and grammar as tools which can express and interpret complex information. Why invent such tools when they're already available? Rather than invent, the model described here capitalizes upon the regular expression syntax of the ECMA262 specification. ECMA262 regExp is richly expressive and platform-neutral. Everybody has an ECMA262 interpreter on their desktop, laptop, and (some) elsewhere. The objectclasses and attributetypes described below are named in terms of "selector" (conditions) and "setter" (actions). These terms are not part of rfc3060's lexicon. I use these terms for these specific types simply to differentiate them from any others. I've described these in the ABNF, which is the usual form of expression for Directory schema. I realize that the PCIMe draft is not a schema proposal, and that the ABNF is not the usual form of expression for Policy WG drafts which are not explicitly about implementation of Policy in the Directory. Forgive me. I'm a little Directory-centric. I hope Policy WG's members have seen and digested enough ABNF by now, so that what I'm describing is more or less obvious. Your comments are most welcome. If you think this has merit but needs work, please say so. If you think it's tripe, say that, too. Long lines are folded, to enhance readability. ##### policy condition stuff objectclass ( oid-oc.X NAME 'selectorPolicyConditionAssociation' DESC 'selectorPolicyCondition is AUXed by subtypes of policyConditionSelector.' SUP policyRuleConditionAssociation STRUCTURAL MUST cn ) attributetype ( oid-at.X NAME 'selectorAttributeOID' DESC 'Value(s) of this attribute of the candidate object are evaluated for selection.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 EQUALITY objectIdentifierMatch SINGLE-VALUE USAGE userApplications ) attributetype ( oid-at.X NAME 'selectorPropertyName' DESC 'Value(s) of this property of the application environment are evaluated for selection.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SINGLE-VALUE USAGE userApplications ) objectclass ( oid-oc.X NAME 'policyConditionSelector' DESC 'Several subtypes of this are used to implement explicit selection semantics by comparing the value of a candidate attribute/value pair or property/value pair to the value of selector criteria. Instances of this SHALL include either selectorAttributeOID attribute/value pair or selectorPropertyName attribute/value pair, but NEVER BOTH.' SUP policyConditionAuxClass AUXILIARY MAY ( selectorAttributeOID $ selectorPropertyName ) ) attributetype ( oid-at.X NAME 'selectorValue' DESC 'Candidate value of selectorAttributeOID or selectorPropertyName is evaluated for selection against the value of this, which constitutes the selection criteria.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch USAGE userApplications ) objectclass ( oid-oc.X NAME 'explicitComparatorConditionSelector' DESC 'subtypes of this support various explicit semantics for evaluating a candidate value against selection criteria. Never create instances of this. ONLY create instances of subtypes of this.' SUP policyConditionSelector AUXILIARY MUST selectorValue ) objectclass ( oid-oc.X NAME 'equalConditionSelector' DESC 'Represents selection according to the semantic of "equal". The candidate value is tested for "equal" with respect to the selection criteria.' SUP explicitComparatorConditionSelector AUXILIARY ) objectclass ( oid-oc.X NAME 'greaterThanConditionSelector' DESC 'Represents selection according to the semantic of "greaterThan". The candidate value is tested for "greaterThan" with respect to the selection criteria.' SUP explicitComparatorConditionSelector AUXILIARY ) objectclass ( oid-oc.X NAME 'lessThanConditionSelector' DESC 'Represents selection according to the semantic of "lessThan". The candidate value is tested for "lessThan" with respect to the selection criteria.' SUP explicitComparatorConditionSelector AUXILIARY ) objectclass ( oid-oc.X NAME 'greaterThanOrEqualConditionSelector' DESC 'Represents selection according to the semantic of "greaterThanOrEqual". The candidate value is tested for "greaterThanOrEqual" with respect to the selection criteria.' SUP explicitComparatorConditionSelector AUXILIARY ) objectclass ( oid-oc.X NAME 'lessThanOrEqualConditionSelector' DESC 'Represents selection according to the semantic of "lessThanOrEqual". The candidate value is tested for "lessThanOrEqual" with respect to the selection criteria.' SUP explicitComparatorConditionSelector AUXILIARY ) objectclass ( oid-oc.X NAME 'beginsWithConditionSelector' DESC 'Represents selection according to the semantic of "beginsWith". The candidate value is tested for "beginsWith" with respect to the selection criteria.' SUP explicitComparatorConditionSelector AUXILIARY ) objectclass ( oid-oc.X NAME 'endsWithConditionSelector' DESC 'Represents selection according to the semantic of "endsWith". The candidate value is tested for "endsWith" with respect to the selection criteria.' SUP explicitComparatorConditionSelector AUXILIARY ) objectclass ( oid-oc.X NAME 'containsConditionSelector' DESC 'Represents selection according to the semantic of "contains". The candidate value is tested for "contains" with respect to the selection criteria.' SUP explicitComparatorConditionSelector AUXILIARY ) objectclass ( oid-oc.X NAME 'existsConditionSelector' DESC 'Represents selection according to the semantic of "exists". The candidate value is tested for "exists". The selection criteria is superfluous in this comparison.' SUP explicitComparatorConditionSelector AUXILIARY ) objectclass ( oid-oc.X NAME 'bitwiseANDConditionSelector' DESC 'Represents selection according to the semantic of "bitwiseAND". The candidate value is tested for "bitwiseAND" with respect to the selection criteria.' SUP explicitComparatorConditionSelector AUXILIARY ) objectclass ( oid-oc.X NAME 'bitwiseINclusiveORConditionSelector' DESC 'Represents selection according to the semantic of "bitwiseINclusiveOR". The candidate value is tested for "bitwiseINclusiveOR" with respect to the selection criteria.' SUP explicitComparatorConditionSelector AUXILIARY ) objectclass ( oid-oc.X NAME 'bitwiseEXclusiveORConditionSelector' DESC 'Represents selection according to the semantic of "bitwiseEXclusiveOR". The candidate value is tested for "bitwiseEXclusiveOR" with respect to the selection criteria.' SUP explicitComparatorConditionSelector AUXILIARY ) objectclass ( oid-oc.X NAME 'onesComplementConditionSelector' DESC 'Represents selection according to the semantic of "onesComplement". The candidate value is tested for "onesComplement". The selection criteria is superfluous in this comparison.' SUP explicitComparatorConditionSelector AUXILIARY ) attributetype ( oid-at.X NAME 'selectorEcma262regExp' DESC 'Candidate value of selectorAttributeOID or selectorPropertyName is evaluated for selection against the ecma262 regular expression which is the value of this. See http://www.ecma.ch/ecma1/stand/ecma-262.htm' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch USAGE userApplications ) objectclass ( oid-oc.X NAME 'ecma262regExpConditionSelector' DESC 'ecma262regExpConditionSelector supports the semantic of evaluating a candidate value against an ecma262 regular expression.' SUP policyConditionSelector AUXILIARY MUST selectorEcma262regExp ) # policy action stuff objectclass ( oid-oc.X NAME 'setterPolicyActionAssociation' DESC 'setterPolicyAction is AUXed by subtypes of policyActionSetter.' SUP policyRuleActionAssociation STRUCTURAL MUST cn ) attributetype ( oid-at.X NAME 'propertyNameToSet' DESC 'Value of this property of the application environment is set or modified by the action.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch USAGE userApplications ) objectclass ( oid-oc.X NAME 'policyActionSetter' DESC 'several subtypes of this implement explicit semantics for setting or modifying the value of an application-defined, application-dependent property.' SUP policyActionAuxClass AUXILIARY MUST propertyNameToSet ) attributetype ( oid-at.X NAME 'setToValue' DESC 'The value of a property of the application environment is set to or modified by the value of this, which constitutes the value setting criteria.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch USAGE userApplications ) objectclass ( oid-oc.X NAME 'assignmentOperatorActionSetter' DESC 'subtypes of this support various semantics of setting a candidate value according to value setting criteria. Never create instances of this. ONLY create instances of subtypes of this.' SUP policyActionSetter AUXILIARY MUST setToValue ) objectclass ( oid-oc.X NAME 'setEqualToAssignmentOperatorActionSetter' DESC 'Represents value assignment according to the semantic of "setEqualTo". The value of the candidate property is assigned or modified by "setEqualTo" with respect to the value setting criteria.' SUP assignmentOperatorActionSetter AUXILIARY ) objectclass ( oid-oc.X NAME 'setPlusEqualToAssignmentOperatorActionSetter' DESC 'Represents value assignment according to the semantic of "setPlusEqualTo". The value of the candidate property is assigned or modified by "setPlusEqualTo" with respect to the value setting criteria.' SUP assignmentOperatorActionSetter AUXILIARY ) objectclass ( oid-oc.X NAME 'setMinusEqualToAssignmentOperatorActionSetter' DESC 'Represents value assignment according to the semantic of "setMinusEqualTo". The value of the candidate property is assigned or modified by "setMinusEqualTo" with respect to the value setting criteria.' SUP assignmentOperatorActionSetter AUXILIARY ) objectclass ( oid-oc.X NAME 'setMultEqualToAssignmentOperatorActionSetter' DESC 'Represents value assignment according to the semantic of "setMultEqualTo". The value of the candidate property is assigned or modified by "setMultEqualTo" with respect to the value setting criteria.' SUP assignmentOperatorActionSetter AUXILIARY ) objectclass ( oid-oc.X NAME 'setDivEqualToAssignmentOperatorActionSetter' DESC 'Represents value assignment according to the semantic of "setDivEqualTo". The value of the candidate property is assigned or modified by "setDivEqualTo" with respect to the value setting criteria.' SUP assignmentOperatorActionSetter AUXILIARY ) objectclass ( oid-oc.X NAME 'setModuloEqualToAssignmentOperatorActionSetter' DESC 'Represents value assignment according to the semantic of "setModuloEqualTo". The value of the candidate property is assigned or modified by "setModuloEqualTo" with respect to the value setting criteria.' SUP assignmentOperatorActionSetter AUXILIARY ) objectclass ( oid-oc.X NAME 'setShiftLeftByAssignmentOperatorActionSetter' DESC 'Represents value assignment according to the semantic of "setShiftLeftBy". The value of the candidate property is assigned or modified by "setShiftLeftBy" with respect to the value setting criteria.' SUP assignmentOperatorActionSetter AUXILIARY ) objectclass ( oid-oc.X NAME 'setShiftRightByAssignmentOperatorActionSetter' DESC 'Represents value assignment according to the semantic of "setShiftRightBy". The value of the candidate property is assigned or modified by "setShiftRightBy" with respect to the value setting criteria.' SUP assignmentOperatorActionSetter AUXILIARY ) objectclass ( oid-oc.X NAME 'setBitwiseANDwithAssignmentOperatorActionSetter' DESC 'Represents value assignment according to the semantic of "setBitwiseANDwith". The value of the candidate property is assigned or modified by "setBitwiseANDwith" with respect to the value setting criteria.' SUP assignmentOperatorActionSetter AUXILIARY ) objectclass ( oid-oc.X NAME 'setBitwiseINclusiveORwithAssignmentOperatorActionSetter' DESC 'Represents value assignment according to the semantic of "setBitwiseINclusiveORwith". The value of the candidate property is assigned or modified by "setBitwiseINclusiveORwith" with respect to the value setting criteria.' SUP assignmentOperatorActionSetter AUXILIARY ) objectclass ( oid-oc.X NAME 'setBitwiseEXclusiveORwithAssignmentOperatorActionSetter' DESC 'Represents value assignment according to the semantic of "setBitwiseEXclusiveORwith". The value of the candidate property is assigned or modified by "setBitwiseEXclusiveORwith" with respect to the value setting criteria.' SUP assignmentOperatorActionSetter AUXILIARY ) objectclass ( oid-oc.X NAME 'setOnesComplementAssignmentOperatorActionSetter' DESC 'Represents value assignment according to the semantic of "setOnesComplement". The value of the candidate property is assigned or modified by "setOnesComplement". The value setting criteria is superfluous in this operation.' SUP assignmentOperatorActionSetter AUXILIARY ) attributetype ( oid-at.X NAME 'setToEcma262regExp' DESC 'The value of a property of the application environment is set or modified according to an evaluation of this ecma262 regular expression. See http://www.ecma.ch/ecma1/stand/ecma-262.htm' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch USAGE userApplications ) objectclass ( oid-oc.X NAME 'ecma262regExpActionSetter' DESC 'ecma262regExpActionSetter supports the semantic of setting a candidate value according to the evaluation an ecma262 regular expression.' SUP policyActionSetter AUXILIARY MUST setToEcma262regExp ) -- #::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::| # Larry Bartz | | # lbartz@parnelli.indy.cr.irs.gov | Ooo, ooo, | # | Ooo, ooo, oooooo! | # | I've got a gnu attitude! | # voice (317) 226-7060 | | # FAX (317) 226-6378 | | #::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::| From majordomo@raleigh.ibm.com Mon Mar 12 10:44:03 2001 Received: from fwns1.raleigh.ibm.com (fwns1d.raleigh.ibm.com [204.146.167.235]) by ietf.org (8.9.1a/8.9.1a) with SMTP id KAA12309 for ; Mon, 12 Mar 2001 10:44:00 -0500 (EST) Received: from rtpmail02.raleigh.ibm.com (rtpmail02.raleigh.ibm.com [9.37.172.48]) by fwns1.raleigh.ibm.com (8.9.0/8.9.0/RTP-FW-1.2) with ESMTP id KAB07364; Mon, 12 Mar 2001 10:42:55 -0500 Received: from rtpaix11.raleigh.ibm.com (rtpaix11.raleigh.ibm.com [9.37.172.4]) by rtpmail02.raleigh.ibm.com (8.8.5/8.8.5/RTP-ral-1.1) with SMTP id KAA32514; Mon, 12 Mar 2001 10:42:54 -0500 Received: by rtpaix11.raleigh.ibm.com (AIX 4.1/UCB 5.64/4.03-RAL) id AA08110; Mon, 12 Mar 2001 10:04:55 -0500 Received: from rtpmail02.raleigh.ibm.com by rtpaix11.raleigh.ibm.com (AIX 4.1/UCB 5.64/4.03-RAL) id AA08100; Mon, 12 Mar 2001 10:04:52 -0500 Received: from lmr (dyn9-37-49-17.raleigh.ibm.com [9.37.49.17]) by rtpmail02.raleigh.ibm.com (8.8.5/8.8.5/RTP-ral-1.1) with SMTP id KAA19942 for ; Mon, 12 Mar 2001 10:04:53 -0500 Message-Id: <008101c0ab05$7b7dc4c0$11312509@raleigh.ibm.com> From: "Lee Rafalow" To: References: <3AA95701.4206B0FE@parnelli.indy.cr.irs.gov> Subject: Policy language? (Re: PCIMe MATCHing and more) Date: Mon, 12 Mar 2001 10:02:39 -0500 Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-Msmail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4522.1200 X-Mimeole: Produced By Microsoft MimeOLE V5.50.4522.1200 Sender: policy-owner@raleigh.ibm.com Precedence: bulk Reply-To: "Lee Rafalow" Content-Transfer-Encoding: 7bit Larry raises good points that, I think, expose a significant problem in the draft. We have taken the step across the line between a declarative specification of policy to a procedural language and in so doing have raised expectations for the completeness of the language. My concern is two fold. First, the step taken is large and, second, the step is nowhere near large enough. My conclusion is that the step shouldn't be taken at all. The introduction of the rule within rule puts program state into the language. That step completely changes the design of the policy engine from that of decision table to that of a language interpreter. In addition to the restructure of the policy engine it changes the performance characteristics when the policy engine is on the data path. Apart from the impact of the change itself, in theory, this change from declarative to procedural might be fine for a PMT or PDP but it's not fine for a PEP (IMHO). Then, once we've taken the step to a procedural language, where is the point at which we stop and say "the rest of the commonly available constructs of a procedural language are not needed for policy specification?" We have implicit and explicit contexts and subcontexts and we even have a suggestion in the draft that the language semantics should include ACID transactions (commit and rollback) so surely we can afford having the more common language features including a full set of comparators and operators, loops and subroutines, etc.? "Slow down!" you say (I hope!)? But why? We have a *terrible* procedural language without these additional semantics. The answer is to either have a good language or no language at all. I vote for the latter. We started this work with the idea that there would be a table-driven decision system specified in the form of rules not a programming language...let's keep it that way! Lee M. Rafalow Voice: 1-919-254-4455; Fax: 1-919-254-6243 IBM Internet Technology Management IBM Corporation P.O. Box 12195, BRQA/502 RTP, NC 27709 USA Alternate email: rafalow@us.ibm.com Home email: rafalow@mindspring.com ----- Original Message ----- From: "Larry S. Bartz" To: "IETF Policy WG LIST" Sent: Friday, March 09, 2001 5:19 PM Subject: PCIMe MATCHing and more > PCIMe's specification of context-sensitive inference of MATCHing > semantics for policy conditions implies a potential that the correct > inference might not be drawn. Unless the schema designer, the > information infrastructure architect, and the policy-interpreting > code designer/programmer are one-in-the-same, there's a lot of > space between the rubber and the road. > > There may be a mechanism by which the MATCHing semantic can be made > explicit. I'm suggesting such a mechanism, in which subtypes of > policyConditionAuxClass are named for the particular comparison > semantic they support. Use of these subtypes can constitute a > semantic contract which binds the designer, implementor, and user > to a model of usage which is unambiguous. > > As with policyCondition's MATCH semantic, policyAction's "set" > semantic could be augmented. Unless one accepts the limitation of a > simple assignment operation, "set" requires context-sensitive > inference, just as condition's MATCH does. > > There may be a mechanism by which the "set" semantic of policyAction > can be made explicit. I'm suggesting such a mechanism, in which > subtypes of policyActionAuxClass are named for the particular > assignment operation they support. Use of these subtypes can constitute > a semantic contract which binds the designer, implementor, and user > to a model of usage which is unambiguous. > > In section 5.14, PCIMe invents syntaxes for complex expressions of > several types of value criteria. These inventions will require > implementors to likewise invent corresponding custom code. > > If the MATCHing semantics of conditions are made explicit, some of > the syntactical constructs of PCIMe 5.14 are not necessary. For > example, expresssions of value ranges can be accomplished by > CNF'd granular policy conditions of the explicit types described > here. > > There may yet be cases in which combinations of granular conditions > cannot suffice, even when augmented by PCIM's CNF, DNF, and negation > facilities. These cases might inspire the invention of syntax, > semantics, and grammar as tools which can express and interpret > complex information. > > Why invent such tools when they're already available? Rather than > invent, the model described here capitalizes upon the regular > expression syntax of the ECMA262 specification. ECMA262 regExp > is richly expressive and platform-neutral. Everybody has an ECMA262 > interpreter on their desktop, laptop, and (some) elsewhere. > > The objectclasses and attributetypes described below are named in terms > of "selector" (conditions) and "setter" (actions). These terms are not > part of rfc3060's lexicon. I use these terms for these specific types > simply to differentiate them from any others. > > I've described these in the ABNF, which is the usual form of expression > for Directory schema. I realize that the PCIMe draft is not a schema > proposal, and that the ABNF is not the usual form of expression for > Policy WG drafts which are not explicitly about implementation of > Policy in the Directory. Forgive me. I'm a little Directory-centric. > I hope Policy WG's members have seen and digested enough ABNF by now, > so that what I'm describing is more or less obvious. > > Your comments are most welcome. If you think this has merit but needs > work, please say so. If you think it's tripe, say that, too. > > Long lines are folded, to enhance readability. > > ##### policy condition stuff > > objectclass ( oid-oc.X > NAME 'selectorPolicyConditionAssociation' > DESC 'selectorPolicyCondition is AUXed by subtypes of > policyConditionSelector.' > SUP policyRuleConditionAssociation > STRUCTURAL > MUST cn > ) > > attributetype ( oid-at.X > NAME 'selectorAttributeOID' > DESC 'Value(s) of this attribute of the candidate object are evaluated > for selection.' > SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 > EQUALITY objectIdentifierMatch > SINGLE-VALUE > USAGE userApplications > ) > > attributetype ( oid-at.X > NAME 'selectorPropertyName' > DESC 'Value(s) of this property of the application environment are > evaluated for selection.' > SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 > EQUALITY caseIgnoreMatch > SUBSTR caseIgnoreSubstringsMatch > SINGLE-VALUE > USAGE userApplications > ) > > objectclass ( oid-oc.X > NAME 'policyConditionSelector' > DESC 'Several subtypes of this are used to implement explicit selection > semantics by comparing the value of a candidate attribute/value pair > or property/value pair to the value of selector criteria. Instances of > this SHALL include either selectorAttributeOID attribute/value pair or > selectorPropertyName attribute/value pair, but NEVER BOTH.' > SUP policyConditionAuxClass > AUXILIARY > MAY ( selectorAttributeOID $ selectorPropertyName ) > ) > > attributetype ( oid-at.X > NAME 'selectorValue' > DESC 'Candidate value of selectorAttributeOID or selectorPropertyName > is evaluated for selection against the value of this, which constitutes > the selection criteria.' > SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 > EQUALITY caseIgnoreMatch > SUBSTR caseIgnoreSubstringsMatch > USAGE userApplications > ) > > objectclass ( oid-oc.X > NAME 'explicitComparatorConditionSelector' > DESC 'subtypes of this support various explicit semantics for > evaluating > a candidate value against selection criteria. Never create instances > of this. ONLY create instances of subtypes of this.' > SUP policyConditionSelector > AUXILIARY > MUST selectorValue > ) > > objectclass ( oid-oc.X > NAME 'equalConditionSelector' > DESC 'Represents selection according to the semantic of "equal". The > candidate value is tested for "equal" with respect to the selection > criteria.' > SUP explicitComparatorConditionSelector > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'greaterThanConditionSelector' > DESC 'Represents selection according to the semantic of > "greaterThan". The candidate value is tested for "greaterThan" with > respect to the selection criteria.' > SUP explicitComparatorConditionSelector > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'lessThanConditionSelector' > DESC 'Represents selection according to the semantic of "lessThan". The > candidate value is tested for "lessThan" with respect to the selection > criteria.' > SUP explicitComparatorConditionSelector > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'greaterThanOrEqualConditionSelector' > DESC 'Represents selection according to the semantic of > "greaterThanOrEqual". The candidate value is tested for > "greaterThanOrEqual" with respect to the selection criteria.' > SUP explicitComparatorConditionSelector > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'lessThanOrEqualConditionSelector' > DESC 'Represents selection according to the semantic of > "lessThanOrEqual". The candidate value is tested for "lessThanOrEqual" > with respect to the selection criteria.' > SUP explicitComparatorConditionSelector > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'beginsWithConditionSelector' > DESC 'Represents selection according to the semantic of "beginsWith". > The > candidate value is tested for "beginsWith" with respect to the > selection > criteria.' > SUP explicitComparatorConditionSelector > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'endsWithConditionSelector' > DESC 'Represents selection according to the semantic of "endsWith". The > candidate value is tested for "endsWith" with respect to the selection > criteria.' > SUP explicitComparatorConditionSelector > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'containsConditionSelector' > DESC 'Represents selection according to the semantic of "contains". The > candidate value is tested for "contains" with respect to the selection > criteria.' > SUP explicitComparatorConditionSelector > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'existsConditionSelector' > DESC 'Represents selection according to the semantic of "exists". The > candidate value is tested for "exists". The selection criteria is > superfluous in this comparison.' > SUP explicitComparatorConditionSelector > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'bitwiseANDConditionSelector' > DESC 'Represents selection according to the semantic of "bitwiseAND". > The > candidate value is tested for "bitwiseAND" with respect to the > selection > criteria.' > SUP explicitComparatorConditionSelector > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'bitwiseINclusiveORConditionSelector' > DESC 'Represents selection according to the semantic of > "bitwiseINclusiveOR". The candidate value is tested for > "bitwiseINclusiveOR" with respect to the selection criteria.' > SUP explicitComparatorConditionSelector > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'bitwiseEXclusiveORConditionSelector' > DESC 'Represents selection according to the semantic of > "bitwiseEXclusiveOR". The candidate value is tested for > "bitwiseEXclusiveOR" with respect to the selection criteria.' > SUP explicitComparatorConditionSelector > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'onesComplementConditionSelector' > DESC 'Represents selection according to the semantic of > "onesComplement". The candidate value is tested for "onesComplement". > The > selection criteria is superfluous in this comparison.' > SUP explicitComparatorConditionSelector > AUXILIARY > ) > > attributetype ( oid-at.X > NAME 'selectorEcma262regExp' > DESC 'Candidate value of selectorAttributeOID or selectorPropertyName > is evaluated for selection against the ecma262 regular expression which > is the value of this. See http://www.ecma.ch/ecma1/stand/ecma-262.htm' > SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 > EQUALITY caseIgnoreMatch > SUBSTR caseIgnoreSubstringsMatch > USAGE userApplications > ) > > objectclass ( oid-oc.X > NAME 'ecma262regExpConditionSelector' > DESC 'ecma262regExpConditionSelector supports the semantic of > evaluating > a candidate value against an ecma262 regular expression.' > SUP policyConditionSelector > AUXILIARY > MUST selectorEcma262regExp > ) > > # policy action stuff > > objectclass ( oid-oc.X > NAME 'setterPolicyActionAssociation' > DESC 'setterPolicyAction is AUXed by subtypes of policyActionSetter.' > SUP policyRuleActionAssociation > STRUCTURAL > MUST cn > ) > > attributetype ( oid-at.X > NAME 'propertyNameToSet' > DESC 'Value of this property of the application environment is set or > modified by the action.' > SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 > EQUALITY caseIgnoreMatch > SUBSTR caseIgnoreSubstringsMatch > USAGE userApplications > ) > > objectclass ( oid-oc.X > NAME 'policyActionSetter' > DESC 'several subtypes of this implement explicit semantics for setting > or modifying the value of an application-defined, application-dependent > property.' > SUP policyActionAuxClass > AUXILIARY > MUST propertyNameToSet > ) > > attributetype ( oid-at.X > NAME 'setToValue' > DESC 'The value of a property of the application environment is set to > or modified by the value of this, which constitutes the value setting > criteria.' > SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 > EQUALITY caseIgnoreMatch > SUBSTR caseIgnoreSubstringsMatch > USAGE userApplications > ) > > objectclass ( oid-oc.X > NAME 'assignmentOperatorActionSetter' > DESC 'subtypes of this support various semantics of setting a candidate > value according to value setting criteria. Never create instances of > this. ONLY create instances of subtypes of this.' > SUP policyActionSetter > AUXILIARY > MUST setToValue > ) > > objectclass ( oid-oc.X > NAME 'setEqualToAssignmentOperatorActionSetter' > DESC 'Represents value assignment according to the semantic of > "setEqualTo". The value of the candidate property is assigned or > modified > by "setEqualTo" with respect to the value setting criteria.' > SUP assignmentOperatorActionSetter > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'setPlusEqualToAssignmentOperatorActionSetter' > DESC 'Represents value assignment according to the semantic of > "setPlusEqualTo". The value of the candidate property is assigned or > modified by "setPlusEqualTo" with respect to the value setting > criteria.' > SUP assignmentOperatorActionSetter > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'setMinusEqualToAssignmentOperatorActionSetter' > DESC 'Represents value assignment according to the semantic of > "setMinusEqualTo". The value of the candidate property is assigned > or modified by "setMinusEqualTo" with respect to the value setting > criteria.' > SUP assignmentOperatorActionSetter > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'setMultEqualToAssignmentOperatorActionSetter' > DESC 'Represents value assignment according to the semantic of > "setMultEqualTo". The value of the candidate property is assigned or > modified by "setMultEqualTo" with respect to the value setting > criteria.' > SUP assignmentOperatorActionSetter > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'setDivEqualToAssignmentOperatorActionSetter' > DESC 'Represents value assignment according to the semantic of > "setDivEqualTo". The value of the candidate property is assigned or > modified by "setDivEqualTo" with respect to the value setting > criteria.' > SUP assignmentOperatorActionSetter > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'setModuloEqualToAssignmentOperatorActionSetter' > DESC 'Represents value assignment according to the semantic of > "setModuloEqualTo". The value of the candidate property is assigned > or modified by "setModuloEqualTo" with respect to the value setting > criteria.' > SUP assignmentOperatorActionSetter > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'setShiftLeftByAssignmentOperatorActionSetter' > DESC 'Represents value assignment according to the semantic of > "setShiftLeftBy". The value of the candidate property is assigned or > modified by "setShiftLeftBy" with respect to the value setting > criteria.' > SUP assignmentOperatorActionSetter > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'setShiftRightByAssignmentOperatorActionSetter' > DESC 'Represents value assignment according to the semantic of > "setShiftRightBy". The value of the candidate property is assigned > or modified by "setShiftRightBy" with respect to the value setting > criteria.' > SUP assignmentOperatorActionSetter > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'setBitwiseANDwithAssignmentOperatorActionSetter' > DESC 'Represents value assignment according to the semantic of > "setBitwiseANDwith". The value of the candidate property is assigned > or modified by "setBitwiseANDwith" with respect to the value setting > criteria.' > SUP assignmentOperatorActionSetter > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'setBitwiseINclusiveORwithAssignmentOperatorActionSetter' > DESC 'Represents value assignment according to the semantic of > "setBitwiseINclusiveORwith". The value of the candidate property is > assigned or modified by "setBitwiseINclusiveORwith" with respect to > the value setting criteria.' > SUP assignmentOperatorActionSetter > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'setBitwiseEXclusiveORwithAssignmentOperatorActionSetter' > DESC 'Represents value assignment according to the semantic of > "setBitwiseEXclusiveORwith". The value of the candidate property is > assigned or modified by "setBitwiseEXclusiveORwith" with respect to > the value setting criteria.' > SUP assignmentOperatorActionSetter > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'setOnesComplementAssignmentOperatorActionSetter' > DESC 'Represents value assignment according to the semantic of > "setOnesComplement". The value of the candidate property is assigned > or modified by "setOnesComplement". The value setting criteria is > superfluous in this operation.' > SUP assignmentOperatorActionSetter > AUXILIARY > ) > > attributetype ( oid-at.X > NAME 'setToEcma262regExp' > DESC 'The value of a property of the application environment is > set or modified according to an evaluation of this ecma262 regular > expression. See http://www.ecma.ch/ecma1/stand/ecma-262.htm' > SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 > EQUALITY caseIgnoreMatch > SUBSTR caseIgnoreSubstringsMatch > USAGE userApplications > ) > > objectclass ( oid-oc.X > NAME 'ecma262regExpActionSetter' > DESC 'ecma262regExpActionSetter supports the semantic of setting > a candidate value according to the evaluation an ecma262 regular > expression.' > SUP policyActionSetter > AUXILIARY > MUST setToEcma262regExp > ) > > -- > #::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::| > # Larry Bartz | | > # lbartz@parnelli.indy.cr.irs.gov | Ooo, ooo, | > # | Ooo, ooo, oooooo! | > # | I've got a gnu attitude! | > # voice (317) 226-7060 | | > # FAX (317) 226-6378 | | > #::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::| From majordomo@raleigh.ibm.com Mon Mar 12 19:34:02 2001 Received: from fwns1.raleigh.ibm.com (fwns1d.raleigh.ibm.com [204.146.167.235]) by ietf.org (8.9.1a/8.9.1a) with SMTP id TAA25823 for ; Mon, 12 Mar 2001 19:34:00 -0500 (EST) Received: from rtpmail02.raleigh.ibm.com (rtpmail02.raleigh.ibm.com [9.37.172.48]) by fwns1.raleigh.ibm.com (8.9.0/8.9.0/RTP-FW-1.2) with ESMTP id TAA10222; Mon, 12 Mar 2001 19:32:34 -0500 Received: from rtpaix11.raleigh.ibm.com (rtpaix11.raleigh.ibm.com [9.37.172.4]) by rtpmail02.raleigh.ibm.com (8.8.5/8.8.5/RTP-ral-1.1) with SMTP id TAA29560; Mon, 12 Mar 2001 19:32:36 -0500 Received: by rtpaix11.raleigh.ibm.com (AIX 4.1/UCB 5.64/4.03-RAL) id AB49850; Mon, 12 Mar 2001 19:02:37 -0500 Received: from rtpmail02.raleigh.ibm.com by rtpaix11.raleigh.ibm.com (AIX 4.1/UCB 5.64/4.03-RAL) id AA46510; Mon, 12 Mar 2001 19:02:34 -0500 Received: from fwns1.raleigh.ibm.com (fwns1.raleigh.ibm.com [9.37.0.3]) by rtpmail02.raleigh.ibm.com (8.8.5/8.8.5/RTP-ral-1.1) with ESMTP id TAA30794 for ; Mon, 12 Mar 2001 19:02:38 -0500 Received: from mail01.san.yahoo.com (mail01.san.yahoo.com [209.132.1.35]) by fwns1.raleigh.ibm.com (8.9.0/8.9.0/RTP-FW-1.2) with ESMTP id TAA28140 for ; Mon, 12 Mar 2001 19:02:34 -0500 Received: from ntearb4s22b666 (64.53.6.155) by mail01.san.yahoo.com (5.1.056) id 3AAD241F0001CC5C; Mon, 12 Mar 2001 15:55:48 -0800 From: "Ron Cohen" To: "Larry S. Bartz" , "IETF Policy WG LIST" Subject: RE: PCIMe MATCHing and more Date: Tue, 13 Mar 2001 02:07:10 +0200 Message-Id: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-Msmail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) X-Mimeole: Produced By Microsoft MimeOLE V5.00.2919.6700 In-Reply-To: <3AA95701.4206B0FE@parnelli.indy.cr.irs.gov> Importance: Normal Sender: policy-owner@raleigh.ibm.com Precedence: bulk Reply-To: "Ron Cohen" Content-Transfer-Encoding: 7bit Larry, I understand that we could have adopted a regular expression approach. But, I'm not sure that I understand what is wrong with the current approach. What is wrong with an IPv4address Value that specify both an address and an address and mask using a semantic convention? Please give an example for your statement "PCIMe specification of context sensitive inference of MATCHing semantics for policy conditions implies a potential that the correct inference might not be drawn", and show how your proposal solves this ambiguity. The ability to define ranges of integers without including them within a condition is to enable to reuse them with different variables. That is, the range 1000-1024 can specify a port range that can be used within a condition that checks this range against a source-port or a destination-port variable. How do you suggest to do that within your proposal? Your propsal to define an explictcomparatorcondition resembles what we had several drafts ago, where we had an operator attribute within simple condition that had enum values of equal, greater than, etc. We moved from this proposal to the current one to allow support mentioned in the previous point as well as other reasons. Possibly we did a mistake there, and we should reconsider. But we need good reasons for that, which I don't see at the moment. Thanks Ron > -----Original Message----- > From: policy-owner@raleigh.ibm.com > [mailto:policy-owner@raleigh.ibm.com]On Behalf Of Larry S. Bartz > Sent: Saturday, March 10, 2001 12:20 AM > To: IETF Policy WG LIST > Subject: PCIMe MATCHing and more > > > PCIMe's specification of context-sensitive inference of MATCHing > semantics for policy conditions implies a potential that the correct > inference might not be drawn. Unless the schema designer, the > information infrastructure architect, and the policy-interpreting > code designer/programmer are one-in-the-same, there's a lot of > space between the rubber and the road. > > There may be a mechanism by which the MATCHing semantic can be made > explicit. I'm suggesting such a mechanism, in which subtypes of > policyConditionAuxClass are named for the particular comparison > semantic they support. Use of these subtypes can constitute a > semantic contract which binds the designer, implementor, and user > to a model of usage which is unambiguous. > > As with policyCondition's MATCH semantic, policyAction's "set" > semantic could be augmented. Unless one accepts the limitation of a > simple assignment operation, "set" requires context-sensitive > inference, just as condition's MATCH does. > > There may be a mechanism by which the "set" semantic of policyAction > can be made explicit. I'm suggesting such a mechanism, in which > subtypes of policyActionAuxClass are named for the particular > assignment operation they support. Use of these subtypes can constitute > a semantic contract which binds the designer, implementor, and user > to a model of usage which is unambiguous. > > In section 5.14, PCIMe invents syntaxes for complex expressions of > several types of value criteria. These inventions will require > implementors to likewise invent corresponding custom code. > > If the MATCHing semantics of conditions are made explicit, some of > the syntactical constructs of PCIMe 5.14 are not necessary. For > example, expresssions of value ranges can be accomplished by > CNF'd granular policy conditions of the explicit types described > here. > > There may yet be cases in which combinations of granular conditions > cannot suffice, even when augmented by PCIM's CNF, DNF, and negation > facilities. These cases might inspire the invention of syntax, > semantics, and grammar as tools which can express and interpret > complex information. > > Why invent such tools when they're already available? Rather than > invent, the model described here capitalizes upon the regular > expression syntax of the ECMA262 specification. ECMA262 regExp > is richly expressive and platform-neutral. Everybody has an ECMA262 > interpreter on their desktop, laptop, and (some) elsewhere. > > The objectclasses and attributetypes described below are named in terms > of "selector" (conditions) and "setter" (actions). These terms are not > part of rfc3060's lexicon. I use these terms for these specific types > simply to differentiate them from any others. > > I've described these in the ABNF, which is the usual form of expression > for Directory schema. I realize that the PCIMe draft is not a schema > proposal, and that the ABNF is not the usual form of expression for > Policy WG drafts which are not explicitly about implementation of > Policy in the Directory. Forgive me. I'm a little Directory-centric. > I hope Policy WG's members have seen and digested enough ABNF by now, > so that what I'm describing is more or less obvious. > > Your comments are most welcome. If you think this has merit but needs > work, please say so. If you think it's tripe, say that, too. > > Long lines are folded, to enhance readability. > > ##### policy condition stuff > > objectclass ( oid-oc.X > NAME 'selectorPolicyConditionAssociation' > DESC 'selectorPolicyCondition is AUXed by subtypes of > policyConditionSelector.' > SUP policyRuleConditionAssociation > STRUCTURAL > MUST cn > ) > > attributetype ( oid-at.X > NAME 'selectorAttributeOID' > DESC 'Value(s) of this attribute of the candidate object are evaluated > for selection.' > SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 > EQUALITY objectIdentifierMatch > SINGLE-VALUE > USAGE userApplications > ) > > attributetype ( oid-at.X > NAME 'selectorPropertyName' > DESC 'Value(s) of this property of the application environment are > evaluated for selection.' > SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 > EQUALITY caseIgnoreMatch > SUBSTR caseIgnoreSubstringsMatch > SINGLE-VALUE > USAGE userApplications > ) > > objectclass ( oid-oc.X > NAME 'policyConditionSelector' > DESC 'Several subtypes of this are used to implement explicit selection > semantics by comparing the value of a candidate attribute/value pair > or property/value pair to the value of selector criteria. Instances of > this SHALL include either selectorAttributeOID attribute/value pair or > selectorPropertyName attribute/value pair, but NEVER BOTH.' > SUP policyConditionAuxClass > AUXILIARY > MAY ( selectorAttributeOID $ selectorPropertyName ) > ) > > attributetype ( oid-at.X > NAME 'selectorValue' > DESC 'Candidate value of selectorAttributeOID or selectorPropertyName > is evaluated for selection against the value of this, which constitutes > the selection criteria.' > SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 > EQUALITY caseIgnoreMatch > SUBSTR caseIgnoreSubstringsMatch > USAGE userApplications > ) > > objectclass ( oid-oc.X > NAME 'explicitComparatorConditionSelector' > DESC 'subtypes of this support various explicit semantics for > evaluating > a candidate value against selection criteria. Never create instances > of this. ONLY create instances of subtypes of this.' > SUP policyConditionSelector > AUXILIARY > MUST selectorValue > ) > > objectclass ( oid-oc.X > NAME 'equalConditionSelector' > DESC 'Represents selection according to the semantic of "equal". The > candidate value is tested for "equal" with respect to the selection > criteria.' > SUP explicitComparatorConditionSelector > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'greaterThanConditionSelector' > DESC 'Represents selection according to the semantic of > "greaterThan". The candidate value is tested for "greaterThan" with > respect to the selection criteria.' > SUP explicitComparatorConditionSelector > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'lessThanConditionSelector' > DESC 'Represents selection according to the semantic of "lessThan". The > candidate value is tested for "lessThan" with respect to the selection > criteria.' > SUP explicitComparatorConditionSelector > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'greaterThanOrEqualConditionSelector' > DESC 'Represents selection according to the semantic of > "greaterThanOrEqual". The candidate value is tested for > "greaterThanOrEqual" with respect to the selection criteria.' > SUP explicitComparatorConditionSelector > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'lessThanOrEqualConditionSelector' > DESC 'Represents selection according to the semantic of > "lessThanOrEqual". The candidate value is tested for "lessThanOrEqual" > with respect to the selection criteria.' > SUP explicitComparatorConditionSelector > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'beginsWithConditionSelector' > DESC 'Represents selection according to the semantic of "beginsWith". > The > candidate value is tested for "beginsWith" with respect to the > selection > criteria.' > SUP explicitComparatorConditionSelector > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'endsWithConditionSelector' > DESC 'Represents selection according to the semantic of "endsWith". The > candidate value is tested for "endsWith" with respect to the selection > criteria.' > SUP explicitComparatorConditionSelector > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'containsConditionSelector' > DESC 'Represents selection according to the semantic of "contains". The > candidate value is tested for "contains" with respect to the selection > criteria.' > SUP explicitComparatorConditionSelector > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'existsConditionSelector' > DESC 'Represents selection according to the semantic of "exists". The > candidate value is tested for "exists". The selection criteria is > superfluous in this comparison.' > SUP explicitComparatorConditionSelector > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'bitwiseANDConditionSelector' > DESC 'Represents selection according to the semantic of "bitwiseAND". > The > candidate value is tested for "bitwiseAND" with respect to the > selection > criteria.' > SUP explicitComparatorConditionSelector > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'bitwiseINclusiveORConditionSelector' > DESC 'Represents selection according to the semantic of > "bitwiseINclusiveOR". The candidate value is tested for > "bitwiseINclusiveOR" with respect to the selection criteria.' > SUP explicitComparatorConditionSelector > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'bitwiseEXclusiveORConditionSelector' > DESC 'Represents selection according to the semantic of > "bitwiseEXclusiveOR". The candidate value is tested for > "bitwiseEXclusiveOR" with respect to the selection criteria.' > SUP explicitComparatorConditionSelector > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'onesComplementConditionSelector' > DESC 'Represents selection according to the semantic of > "onesComplement". The candidate value is tested for "onesComplement". > The > selection criteria is superfluous in this comparison.' > SUP explicitComparatorConditionSelector > AUXILIARY > ) > > attributetype ( oid-at.X > NAME 'selectorEcma262regExp' > DESC 'Candidate value of selectorAttributeOID or selectorPropertyName > is evaluated for selection against the ecma262 regular expression which > is the value of this. See http://www.ecma.ch/ecma1/stand/ecma-262.htm' > SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 > EQUALITY caseIgnoreMatch > SUBSTR caseIgnoreSubstringsMatch > USAGE userApplications > ) > > objectclass ( oid-oc.X > NAME 'ecma262regExpConditionSelector' > DESC 'ecma262regExpConditionSelector supports the semantic of > evaluating > a candidate value against an ecma262 regular expression.' > SUP policyConditionSelector > AUXILIARY > MUST selectorEcma262regExp > ) > > # policy action stuff > > objectclass ( oid-oc.X > NAME 'setterPolicyActionAssociation' > DESC 'setterPolicyAction is AUXed by subtypes of policyActionSetter.' > SUP policyRuleActionAssociation > STRUCTURAL > MUST cn > ) > > attributetype ( oid-at.X > NAME 'propertyNameToSet' > DESC 'Value of this property of the application environment is set or > modified by the action.' > SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 > EQUALITY caseIgnoreMatch > SUBSTR caseIgnoreSubstringsMatch > USAGE userApplications > ) > > objectclass ( oid-oc.X > NAME 'policyActionSetter' > DESC 'several subtypes of this implement explicit semantics for setting > or modifying the value of an application-defined, application-dependent > property.' > SUP policyActionAuxClass > AUXILIARY > MUST propertyNameToSet > ) > > attributetype ( oid-at.X > NAME 'setToValue' > DESC 'The value of a property of the application environment is set to > or modified by the value of this, which constitutes the value setting > criteria.' > SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 > EQUALITY caseIgnoreMatch > SUBSTR caseIgnoreSubstringsMatch > USAGE userApplications > ) > > objectclass ( oid-oc.X > NAME 'assignmentOperatorActionSetter' > DESC 'subtypes of this support various semantics of setting a candidate > value according to value setting criteria. Never create instances of > this. ONLY create instances of subtypes of this.' > SUP policyActionSetter > AUXILIARY > MUST setToValue > ) > > objectclass ( oid-oc.X > NAME 'setEqualToAssignmentOperatorActionSetter' > DESC 'Represents value assignment according to the semantic of > "setEqualTo". The value of the candidate property is assigned or > modified > by "setEqualTo" with respect to the value setting criteria.' > SUP assignmentOperatorActionSetter > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'setPlusEqualToAssignmentOperatorActionSetter' > DESC 'Represents value assignment according to the semantic of > "setPlusEqualTo". The value of the candidate property is assigned or > modified by "setPlusEqualTo" with respect to the value setting > criteria.' > SUP assignmentOperatorActionSetter > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'setMinusEqualToAssignmentOperatorActionSetter' > DESC 'Represents value assignment according to the semantic of > "setMinusEqualTo". The value of the candidate property is assigned > or modified by "setMinusEqualTo" with respect to the value setting > criteria.' > SUP assignmentOperatorActionSetter > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'setMultEqualToAssignmentOperatorActionSetter' > DESC 'Represents value assignment according to the semantic of > "setMultEqualTo". The value of the candidate property is assigned or > modified by "setMultEqualTo" with respect to the value setting > criteria.' > SUP assignmentOperatorActionSetter > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'setDivEqualToAssignmentOperatorActionSetter' > DESC 'Represents value assignment according to the semantic of > "setDivEqualTo". The value of the candidate property is assigned or > modified by "setDivEqualTo" with respect to the value setting > criteria.' > SUP assignmentOperatorActionSetter > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'setModuloEqualToAssignmentOperatorActionSetter' > DESC 'Represents value assignment according to the semantic of > "setModuloEqualTo". The value of the candidate property is assigned > or modified by "setModuloEqualTo" with respect to the value setting > criteria.' > SUP assignmentOperatorActionSetter > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'setShiftLeftByAssignmentOperatorActionSetter' > DESC 'Represents value assignment according to the semantic of > "setShiftLeftBy". The value of the candidate property is assigned or > modified by "setShiftLeftBy" with respect to the value setting > criteria.' > SUP assignmentOperatorActionSetter > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'setShiftRightByAssignmentOperatorActionSetter' > DESC 'Represents value assignment according to the semantic of > "setShiftRightBy". The value of the candidate property is assigned > or modified by "setShiftRightBy" with respect to the value setting > criteria.' > SUP assignmentOperatorActionSetter > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'setBitwiseANDwithAssignmentOperatorActionSetter' > DESC 'Represents value assignment according to the semantic of > "setBitwiseANDwith". The value of the candidate property is assigned > or modified by "setBitwiseANDwith" with respect to the value setting > criteria.' > SUP assignmentOperatorActionSetter > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'setBitwiseINclusiveORwithAssignmentOperatorActionSetter' > DESC 'Represents value assignment according to the semantic of > "setBitwiseINclusiveORwith". The value of the candidate property is > assigned or modified by "setBitwiseINclusiveORwith" with respect to > the value setting criteria.' > SUP assignmentOperatorActionSetter > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'setBitwiseEXclusiveORwithAssignmentOperatorActionSetter' > DESC 'Represents value assignment according to the semantic of > "setBitwiseEXclusiveORwith". The value of the candidate property is > assigned or modified by "setBitwiseEXclusiveORwith" with respect to > the value setting criteria.' > SUP assignmentOperatorActionSetter > AUXILIARY > ) > > objectclass ( oid-oc.X > NAME 'setOnesComplementAssignmentOperatorActionSetter' > DESC 'Represents value assignment according to the semantic of > "setOnesComplement". The value of the candidate property is assigned > or modified by "setOnesComplement". The value setting criteria is > superfluous in this operation.' > SUP assignmentOperatorActionSetter > AUXILIARY > ) > > attributetype ( oid-at.X > NAME 'setToEcma262regExp' > DESC 'The value of a property of the application environment is > set or modified according to an evaluation of this ecma262 regular > expression. See http://www.ecma.ch/ecma1/stand/ecma-262.htm' > SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 > EQUALITY caseIgnoreMatch > SUBSTR caseIgnoreSubstringsMatch > USAGE userApplications > ) > > objectclass ( oid-oc.X > NAME 'ecma262regExpActionSetter' > DESC 'ecma262regExpActionSetter supports the semantic of setting > a candidate value according to the evaluation an ecma262 regular > expression.' > SUP policyActionSetter > AUXILIARY > MUST setToEcma262regExp > ) > > -- > #::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::| > # Larry Bartz | | > # lbartz@parnelli.indy.cr.irs.gov | Ooo, ooo, | > # | Ooo, ooo, oooooo! | > # | I've got a gnu attitude! | > # voice (317) 226-7060 | | > # FAX (317) 226-6378 | | > #::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::| From majordomo@raleigh.ibm.com Tue Mar 13 21:06:50 2001 Received: from fwns1.raleigh.ibm.com (fwns1d.raleigh.ibm.com [204.146.167.235]) by ietf.org (8.9.1a/8.9.1a) with SMTP id VAA01694 for ; Tue, 13 Mar 2001 21:06:45 -0500 (EST) Received: from rtpmail02.raleigh.ibm.com (rtpmail02.raleigh.ibm.com [9.37.172.48]) by fwns1.raleigh.ibm.com (8.9.0/8.9.0/RTP-FW-1.2) with ESMTP id VAA32382; Tue, 13 Mar 2001 21:06:11 -0500 Received: from rtpaix11.raleigh.ibm.com (rtpaix11.raleigh.ibm.com [9.37.172.4]) by rtpmail02.raleigh.ibm.com (8.8.5/8.8.5/RTP-ral-1.1) with SMTP id VAA26478; Tue, 13 Mar 2001 21:06:12 -0500 Received: by rtpaix11.raleigh.ibm.com (AIX 4.1/UCB 5.64/4.03-RAL) id AA39716; Tue, 13 Mar 2001 11:33:59 -0500 Received: from rtpmail03.raleigh.ibm.com by rtpaix11.raleigh.ibm.com (AIX 4.1/UCB 5.64/4.03-RAL) id AA40086; Tue, 13 Mar 2001 11:33:38 -0500 Received: from fwns2.raleigh.ibm.com (fwns2.raleigh.ibm.com [9.37.0.4]) by rtpmail03.raleigh.ibm.com (8.8.5/8.8.5/RTP-ral-1.1) with ESMTP id LAA30814 for ; Tue, 13 Mar 2001 11:33:38 -0500 Received: from mx-relay2.treas.gov (mx-relay2.treas.gov [199.196.144.6]) by fwns2.raleigh.ibm.com (8.9.0/8.9.0/RTP-FW-1.2) with ESMTP id LAA28206 for ; Tue, 13 Mar 2001 11:33:33 -0500 Received: from tias4.treas.gov (tias-gw4.treas.gov [199.196.144.14]) by mx-relay2.treas.gov (8.9.1b+Sun/8.9.3) with SMTP id LAA06450; Tue, 13 Mar 2001 11:33:31 -0500 (EST) Received: from mailhub.net.treas.gov by tias4.treas.gov via smtpd (for mx-relay.treas.gov [199.196.144.6]) with SMTP; 13 Mar 2001 16:33:31 UT Received: from mears.indy.cr.irs.gov (mailhub-3 [10.7.8.11]) by mailhub-3.net.treas.gov (8.9.3+Sun/8.9.3) with ESMTP id LAA22847; Tue, 13 Mar 2001 11:30:39 -0500 (EST) Received: from parnelli.indy.cr.irs.gov (IDENT:lsbart35@localhost [127.0.0.1]) by mears.indy.cr.irs.gov (8.9.3/8.9.3) with ESMTP id LAA19000; Tue, 13 Mar 2001 11:33:24 -0500 Message-Id: <3AAE4BD4.DE8AFACA@parnelli.indy.cr.irs.gov> Date: Tue, 13 Mar 2001 11:33:24 -0500 From: "Larry S. Bartz" X-Mailer: Mozilla 4.72 [en] (X11; U; Linux 2.2.14-5.0smp i686) X-Accept-Language: en Mime-Version: 1.0 To: Ron Cohen Cc: IETF Policy WG LIST Subject: Re: PCIMe MATCHing and more References: Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: policy-owner@raleigh.ibm.com Precedence: bulk Reply-To: "Larry S. Bartz" Content-Transfer-Encoding: 7bit Ron Cohen wrote: > > Larry, > > I understand that we could have adopted a regular expression approach. The explicit condition types which I described provide for all of the comparison operations. When we combine these with rfc3060's CNF, DNF, and negation facilities, we have a capability to compose complex condition specs from a well-defined, relatively small set of granular condition objects. I meant *this* to be the focus of my approach. If my message gave the impression that "regular expression" was the focus, my bad. The use of regular expression syntax is not a premiere feature of the strategy I've described. The use of regular expressions in conditions should be only in the rare, exceptional cases. It is there as an escape hatch for cases I couldn't imagine yet. The recommendation of ecma262 was simply to avoid requiring anyone to invent their own escape hatch. Further, it avoids requiring everyone to be able to recognize and negotiate everybody else's funky (or sublime) homemade escape hatches. > But, > I'm not sure that I understand what is wrong with the current approach. What > is wrong with an IPv4address Value that specify both an address and an > address and mask using a semantic convention? If you can't determine the semantic of a variable unless and until you evaluate an instance value which is assigned to that variable, then you've got an ambiguous semantic. This might be fine under tightly controlled implementations; implementations under which all interpreters agree that they'll accept and comprehend "one of these" or "one of those" or "any one of these five kinds". But I don't think this is an appropriate strategy to promote and canonize as a strategy of a "core" information model. It's not reusable enough, not generalizable enough to be called "core". > Please give an example for > your statement "PCIMe specification of context sensitive inference of > MATCHing semantics for policy conditions implies a potential that the > correct inference might not be drawn", and show how your proposal solves > this ambiguity. I intend not to resolve ambiguity, but to avoid ambiguity. The last paragraph of PCIMe 4.8.3 reveals the weakness I intended to address in my proposal. I'll paraphrase: "The "If" term and the "MATCH" operator are not directly modeled -- they are implied." and "Text accompanying the value class definition SHOULD be used as a guideline for interpreting the semantics of the MATCH relationship." By PCIMe's definition, an implementation cannot explicitly identify exactly what MATCH means. PCIMe resorts to unstructured and unparseable text as a guideline. There is a an arguably finite set of distinct and explicitly-defineable MATCH terms. I've laid 'em out. There aren't that many. It's easier to avoid ambiguity than it is to resolve it. > > The ability to define ranges of integers without including them within a > condition is to enable to reuse them with different variables. That is, the > range 1000-1024 can specify a port range that can be used within a condition > that checks this range against a source-port or a destination-port variable. > How do you suggest to do that within your proposal? I wouldn't reuse the integer values. I would reuse the conditions. This follows the strategy of rfc3060. I would specify two reusable condition instances of greaterThanOrEqualConditionSelector and lessThanOrEqualConditionSelector. These two could be components of a reusable conditionList. Or each could be reusable, on its own, without regard for the other. > > Your propsal to define an explictcomparatorcondition resembles what we had > several drafts ago, where we had an operator attribute within simple > condition that had enum values of equal, greater than, etc. We moved from > this proposal to the current one to allow support mentioned in the previous > point as well as other reasons. Possibly we did a mistake there, and we > should reconsider. But we need good reasons for that, which I don't see at > the moment. I've got all nine PCIM drafts on hand. I don't see any discussion of an enum of operator attributes in the PCIM drafts. I missed it. Where is it? If Lee Rafalow is right, if PCIMe should withdraw from this procedural direction, I'll be just as happy. I think that what I've described *is* a "table-driven decision system" (to quote Lee) which conforms to the letter and the spirit of rfc3060. I agree with Lee's assertion that PCIMe is something else. If what I've described is nothing more than an rfc3060-conformant local implementation, fine by me. Explicitly yours, Larry > > Thanks > Ron > > > -----Original Message----- > > From: policy-owner@raleigh.ibm.com > > [mailto:policy-owner@raleigh.ibm.com]On Behalf Of Larry S. Bartz > > Sent: Saturday, March 10, 2001 12:20 AM > > To: IETF Policy WG LIST > > Subject: PCIMe MATCHing and more > > > > > > PCIMe's specification of context-sensitive inference of MATCHing > > semantics for policy conditions implies a potential that the correct > > inference might not be drawn. Unless the schema designer, the > > information infrastructure architect, and the policy-interpreting > > code designer/programmer are one-in-the-same, there's a lot of > > space between the rubber and the road. > > > > There may be a mechanism by which the MATCHing semantic can be made > > explicit. I'm suggesting such a mechanism, in which subtypes of > > policyConditionAuxClass are named for the particular comparison > > semantic they support. Use of these subtypes can constitute a > > semantic contract which binds the designer, implementor, and user > > to a model of usage which is unambiguous. > > > > As with policyCondition's MATCH semantic, policyAction's "set" > > semantic could be augmented. Unless one accepts the limitation of a > > simple assignment operation, "set" requires context-sensitive > > inference, just as condition's MATCH does. > > > > There may be a mechanism by which the "set" semantic of policyAction > > can be made explicit. I'm suggesting such a mechanism, in which > > subtypes of policyActionAuxClass are named for the particular > > assignment operation they support. Use of these subtypes can constitute > > a semantic contract which binds the designer, implementor, and user > > to a model of usage which is unambiguous. > > > > In section 5.14, PCIMe invents syntaxes for complex expressions of > > several types of value criteria. These inventions will require > > implementors to likewise invent corresponding custom code. > > > > If the MATCHing semantics of conditions are made explicit, some of > > the syntactical constructs of PCIMe 5.14 are not necessary. For > > example, expresssions of value ranges can be accomplished by > > CNF'd granular policy conditions of the explicit types described > > here. > > > > There may yet be cases in which combinations of granular conditions > > cannot suffice, even when augmented by PCIM's CNF, DNF, and negation > > facilities. These cases might inspire the invention of syntax, > > semantics, and grammar as tools which can express and interpret > > complex information. > > > > Why invent such tools when they're already available? Rather than > > invent, the model described here capitalizes upon the regular > > expression syntax of the ECMA262 specification. ECMA262 regExp > > is richly expressive and platform-neutral. Everybody has an ECMA262 > > interpreter on their desktop, laptop, and (some) elsewhere. > > > > The objectclasses and attributetypes described below are named in terms > > of "selector" (conditions) and "setter" (actions). These terms are not > > part of rfc3060's lexicon. I use these terms for these specific types > > simply to differentiate them from any others. > > > > I've described these in the ABNF, which is the usual form of expression > > for Directory schema. I realize that the PCIMe draft is not a schema > > proposal, and that the ABNF is not the usual form of expression for > > Policy WG drafts which are not explicitly about implementation of > > Policy in the Directory. Forgive me. I'm a little Directory-centric. > > I hope Policy WG's members have seen and digested enough ABNF by now, > > so that what I'm describing is more or less obvious. > > > > Your comments are most welcome. If you think this has merit but needs > > work, please say so. If you think it's tripe, say that, too. > > > > Long lines are folded, to enhance readability. > > > > ##### policy condition stuff > > > > objectclass ( oid-oc.X > > NAME 'selectorPolicyConditionAssociation' > > DESC 'selectorPolicyCondition is AUXed by subtypes of > > policyConditionSelector.' > > SUP policyRuleConditionAssociation > > STRUCTURAL > > MUST cn > > ) > > > > attributetype ( oid-at.X > > NAME 'selectorAttributeOID' > > DESC 'Value(s) of this attribute of the candidate object are evaluated > > for selection.' > > SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 > > EQUALITY objectIdentifierMatch > > SINGLE-VALUE > > USAGE userApplications > > ) > > > > attributetype ( oid-at.X > > NAME 'selectorPropertyName' > > DESC 'Value(s) of this property of the application environment are > > evaluated for selection.' > > SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 > > EQUALITY caseIgnoreMatch > > SUBSTR caseIgnoreSubstringsMatch > > SINGLE-VALUE > > USAGE userApplications > > ) > > > > objectclass ( oid-oc.X > > NAME 'policyConditionSelector' > > DESC 'Several subtypes of this are used to implement explicit selection > > semantics by comparing the value of a candidate attribute/value pair > > or property/value pair to the value of selector criteria. Instances of > > this SHALL include either selectorAttributeOID attribute/value pair or > > selectorPropertyName attribute/value pair, but NEVER BOTH.' > > SUP policyConditionAuxClass > > AUXILIARY > > MAY ( selectorAttributeOID $ selectorPropertyName ) > > ) > > > > attributetype ( oid-at.X > > NAME 'selectorValue' > > DESC 'Candidate value of selectorAttributeOID or selectorPropertyName > > is evaluated for selection against the value of this, which constitutes > > the selection criteria.' > > SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 > > EQUALITY caseIgnoreMatch > > SUBSTR caseIgnoreSubstringsMatch > > USAGE userApplications > > ) > > > > objectclass ( oid-oc.X > > NAME 'explicitComparatorConditionSelector' > > DESC 'subtypes of this support various explicit semantics for > > evaluating > > a candidate value against selection criteria. Never create instances > > of this. ONLY create instances of subtypes of this.' > > SUP policyConditionSelector > > AUXILIARY > > MUST selectorValue > > ) > > > > objectclass ( oid-oc.X > > NAME 'equalConditionSelector' > > DESC 'Represents selection according to the semantic of "equal". The > > candidate value is tested for "equal" with respect to the selection > > criteria.' > > SUP explicitComparatorConditionSelector > > AUXILIARY > > ) > > > > objectclass ( oid-oc.X > > NAME 'greaterThanConditionSelector' > > DESC 'Represents selection according to the semantic of > > "greaterThan". The candidate value is tested for "greaterThan" with > > respect to the selection criteria.' > > SUP explicitComparatorConditionSelector > > AUXILIARY > > ) > > > > objectclass ( oid-oc.X > > NAME 'lessThanConditionSelector' > > DESC 'Represents selection according to the semantic of "lessThan". The > > candidate value is tested for "lessThan" with respect to the selection > > criteria.' > > SUP explicitComparatorConditionSelector > > AUXILIARY > > ) > > > > objectclass ( oid-oc.X > > NAME 'greaterThanOrEqualConditionSelector' > > DESC 'Represents selection according to the semantic of > > "greaterThanOrEqual". The candidate value is tested for > > "greaterThanOrEqual" with respect to the selection criteria.' > > SUP explicitComparatorConditionSelector > > AUXILIARY > > ) > > > > objectclass ( oid-oc.X > > NAME 'lessThanOrEqualConditionSelector' > > DESC 'Represents selection according to the semantic of > > "lessThanOrEqual". The candidate value is tested for "lessThanOrEqual" > > with respect to the selection criteria.' > > SUP explicitComparatorConditionSelector > > AUXILIARY > > ) > > > > objectclass ( oid-oc.X > > NAME 'beginsWithConditionSelector' > > DESC 'Represents selection according to the semantic of "beginsWith". > > The > > candidate value is tested for "beginsWith" with respect to the > > selection > > criteria.' > > SUP explicitComparatorConditionSelector > > AUXILIARY > > ) > > > > objectclass ( oid-oc.X > > NAME 'endsWithConditionSelector' > > DESC 'Represents selection according to the semantic of "endsWith". The > > candidate value is tested for "endsWith" with respect to the selection > > criteria.' > > SUP explicitComparatorConditionSelector > > AUXILIARY > > ) > > > > objectclass ( oid-oc.X > > NAME 'containsConditionSelector' > > DESC 'Represents selection according to the semantic of "contains". The > > candidate value is tested for "contains" with respect to the selection > > criteria.' > > SUP explicitComparatorConditionSelector > > AUXILIARY > > ) > > > > objectclass ( oid-oc.X > > NAME 'existsConditionSelector' > > DESC 'Represents selection according to the semantic of "exists". The > > candidate value is tested for "exists". The selection criteria is > > superfluous in this comparison.' > > SUP explicitComparatorConditionSelector > > AUXILIARY > > ) > > > > objectclass ( oid-oc.X > > NAME 'bitwiseANDConditionSelector' > > DESC 'Represents selection according to the semantic of "bitwiseAND". > > The > > candidate value is tested for "bitwiseAND" with respect to the > > selection > > criteria.' > > SUP explicitComparatorConditionSelector > > AUXILIARY > > ) > > > > objectclass ( oid-oc.X > > NAME 'bitwiseINclusiveORConditionSelector' > > DESC 'Represents selection according to the semantic of > > "bitwiseINclusiveOR". The candidate value is tested for > > "bitwiseINclusiveOR" with respect to the selection criteria.' > > SUP explicitComparatorConditionSelector > > AUXILIARY > > ) > > > > objectclass ( oid-oc.X > > NAME 'bitwiseEXclusiveORConditionSelector' > > DESC 'Represents selection according to the semantic of > > "bitwiseEXclusiveOR". The candidate value is tested for > > "bitwiseEXclusiveOR" with respect to the selection criteria.' > > SUP explicitComparatorConditionSelector > > AUXILIARY > > ) > > > > objectclass ( oid-oc.X > > NAME 'onesComplementConditionSelector' > > DESC 'Represents selection according to the semantic of > > "onesComplement". The candidate value is tested for "onesComplement". > > The > > selection criteria is superfluous in this comparison.' > > SUP explicitComparatorConditionSelector > > AUXILIARY > > ) > > > > attributetype ( oid-at.X > > NAME 'selectorEcma262regExp' > > DESC 'Candidate value of selectorAttributeOID or selectorPropertyName > > is evaluated for selection against the ecma262 regular expression which > > is the value of this. See http://www.ecma.ch/ecma1/stand/ecma-262.htm' > > SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 > > EQUALITY caseIgnoreMatch > > SUBSTR caseIgnoreSubstringsMatch > > USAGE userApplications > > ) > > > > objectclass ( oid-oc.X > > NAME 'ecma262regExpConditionSelector' > > DESC 'ecma262regExpConditionSelector supports the semantic of > > evaluating > > a candidate value against an ecma262 regular expression.' > > SUP policyConditionSelector > > AUXILIARY > > MUST selectorEcma262regExp > > ) > > > > # policy action stuff > > > > objectclass ( oid-oc.X > > NAME 'setterPolicyActionAssociation' > > DESC 'setterPolicyAction is AUXed by subtypes of policyActionSetter.' > > SUP policyRuleActionAssociation > > STRUCTURAL > > MUST cn > > ) > > > > attributetype ( oid-at.X > > NAME 'propertyNameToSet' > > DESC 'Value of this property of the application environment is set or > > modified by the action.' > > SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 > > EQUALITY caseIgnoreMatch > > SUBSTR caseIgnoreSubstringsMatch > > USAGE userApplications > > ) > > > > objectclass ( oid-oc.X > > NAME 'policyActionSetter' > > DESC 'several subtypes of this implement explicit semantics for setting > > or modifying the value of an application-defined, application-dependent > > property.' > > SUP policyActionAuxClass > > AUXILIARY > > MUST propertyNameToSet > > ) > > > > attributetype ( oid-at.X > > NAME 'setToValue' > > DESC 'The value of a property of the application environment is set to > > or modified by the value of this, which constitutes the value setting > > criteria.' > > SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 > > EQUALITY caseIgnoreMatch > > SUBSTR caseIgnoreSubstringsMatch > > USAGE userApplications > > ) > > > > objectclass ( oid-oc.X > > NAME 'assignmentOperatorActionSetter' > > DESC 'subtypes of this support various semantics of setting a candidate > > value according to value setting criteria. Never create instances of > > this. ONLY create instances of subtypes of this.' > > SUP policyActionSetter > > AUXILIARY > > MUST setToValue > > ) > > > > objectclass ( oid-oc.X > > NAME 'setEqualToAssignmentOperatorActionSetter' > > DESC 'Represents value assignment according to the semantic of > > "setEqualTo". The value of the candidate property is assigned or > > modified > > by "setEqualTo" with respect to the value setting criteria.' > > SUP assignmentOperatorActionSetter > > AUXILIARY > > ) > > > > objectclass ( oid-oc.X > > NAME 'setPlusEqualToAssignmentOperatorActionSetter' > > DESC 'Represents value assignment according to the semantic of > > "setPlusEqualTo". The value of the candidate property is assigned or > > modified by "setPlusEqualTo" with respect to the value setting > > criteria.' > > SUP assignmentOperatorActionSetter > > AUXILIARY > > ) > > > > objectclass ( oid-oc.X > > NAME 'setMinusEqualToAssignmentOperatorActionSetter' > > DESC 'Represents value assignment according to the semantic of > > "setMinusEqualTo". The value of the candidate property is assigned > > or modified by "setMinusEqualTo" with respect to the value setting > > criteria.' > > SUP assignmentOperatorActionSetter > > AUXILIARY > > ) > > > > objectclass ( oid-oc.X > > NAME 'setMultEqualToAssignmentOperatorActionSetter' > > DESC 'Represents value assignment according to the semantic of > > "setMultEqualTo". The value of the candidate property is assigned or > > modified by "setMultEqualTo" with respect to the value setting > > criteria.' > > SUP assignmentOperatorActionSetter > > AUXILIARY > > ) > > > > objectclass ( oid-oc.X > > NAME 'setDivEqualToAssignmentOperatorActionSetter' > > DESC 'Represents value assignment according to the semantic of > > "setDivEqualTo". The value of the candidate property is assigned or > > modified by "setDivEqualTo" with respect to the value setting > > criteria.' > > SUP assignmentOperatorActionSetter > > AUXILIARY > > ) > > > > objectclass ( oid-oc.X > > NAME 'setModuloEqualToAssignmentOperatorActionSetter' > > DESC 'Represents value assignment according to the semantic of > > "setModuloEqualTo". The value of the candidate property is assigned > > or modified by "setModuloEqualTo" with respect to the value setting > > criteria.' > > SUP assignmentOperatorActionSetter > > AUXILIARY > > ) > > > > objectclass ( oid-oc.X > > NAME 'setShiftLeftByAssignmentOperatorActionSetter' > > DESC 'Represents value assignment according to the semantic of > > "setShiftLeftBy". The value of the candidate property is assigned or > > modified by "setShiftLeftBy" with respect to the value setting > > criteria.' > > SUP assignmentOperatorActionSetter > > AUXILIARY > > ) > > > > objectclass ( oid-oc.X > > NAME 'setShiftRightByAssignmentOperatorActionSetter' > > DESC 'Represents value assignment according to the semantic of > > "setShiftRightBy". The value of the candidate property is assigned > > or modified by "setShiftRightBy" with respect to the value setting > > criteria.' > > SUP assignmentOperatorActionSetter > > AUXILIARY > > ) > > > > objectclass ( oid-oc.X > > NAME 'setBitwiseANDwithAssignmentOperatorActionSetter' > > DESC 'Represents value assignment according to the semantic of > > "setBitwiseANDwith". The value of the candidate property is assigned > > or modified by "setBitwiseANDwith" with respect to the value setting > > criteria.' > > SUP assignmentOperatorActionSetter > > AUXILIARY > > ) > > > > objectclass ( oid-oc.X > > NAME 'setBitwiseINclusiveORwithAssignmentOperatorActionSetter' > > DESC 'Represents value assignment according to the semantic of > > "setBitwiseINclusiveORwith". The value of the candidate property is > > assigned or modified by "setBitwiseINclusiveORwith" with respect to > > the value setting criteria.' > > SUP assignmentOperatorActionSetter > > AUXILIARY > > ) > > > > objectclass ( oid-oc.X > > NAME 'setBitwiseEXclusiveORwithAssignmentOperatorActionSetter' > > DESC 'Represents value assignment according to the semantic of > > "setBitwiseEXclusiveORwith". The value of the candidate property is > > assigned or modified by "setBitwiseEXclusiveORwith" with respect to > > the value setting criteria.' > > SUP assignmentOperatorActionSetter > > AUXILIARY > > ) > > > > objectclass ( oid-oc.X > > NAME 'setOnesComplementAssignmentOperatorActionSetter' > > DESC 'Represents value assignment according to the semantic of > > "setOnesComplement". The value of the candidate property is assigned > > or modified by "setOnesComplement". The value setting criteria is > > superfluous in this operation.' > > SUP assignmentOperatorActionSetter > > AUXILIARY > > ) > > > > attributetype ( oid-at.X > > NAME 'setToEcma262regExp' > > DESC 'The value of a property of the application environment is > > set or modified according to an evaluation of this ecma262 regular > > expression. See http://www.ecma.ch/ecma1/stand/ecma-262.htm' > > SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 > > EQUALITY caseIgnoreMatch > > SUBSTR caseIgnoreSubstringsMatch > > USAGE userApplications > > ) > > > > objectclass ( oid-oc.X > > NAME 'ecma262regExpActionSetter' > > DESC 'ecma262regExpActionSetter supports the semantic of setting > > a candidate value according to the evaluation an ecma262 regular > > expression.' > > SUP policyActionSetter > > AUXILIARY > > MUST setToEcma262regExp > > ) > > -- #::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::| # Larry Bartz | | # lbartz@parnelli.indy.cr.irs.gov | Ooo, ooo, | # | Ooo, ooo, oooooo! | # | I've got a gnu attitude! | # voice (317) 226-7060 | | # FAX (317) 226-6378 | | #::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::| From majordomo@raleigh.ibm.com Wed Mar 14 08:43:04 2001 Received: from fwns2.raleigh.ibm.com (fwns2d.raleigh.ibm.com [204.146.167.236]) by ietf.org (8.9.1a/8.9.1a) with SMTP id IAA23325 for ; Wed, 14 Mar 2001 08:43:03 -0500 (EST) Received: from rtpmail03.raleigh.ibm.com (rtpmail03.raleigh.ibm.com [9.37.172.47]) by fwns2.raleigh.ibm.com (8.9.0/8.9.0/RTP-FW-1.2) with ESMTP id IAA34378; Wed, 14 Mar 2001 08:35:09 -0500 Received: from rtpaix11.raleigh.ibm.com (rtpaix11.raleigh.ibm.com [9.37.172.4]) by rtpmail03.raleigh.ibm.com (8.8.5/8.8.5/RTP-ral-1.1) with SMTP id IAA24468; Wed, 14 Mar 2001 08:35:05 -0500 Received: by rtpaix11.raleigh.ibm.com (AIX 4.1/UCB 5.64/4.03-RAL) id AA42242; Wed, 14 Mar 2001 08:03:40 -0500 Received: from rtpmail03.raleigh.ibm.com by rtpaix11.raleigh.ibm.com (AIX 4.1/UCB 5.64/4.03-RAL) id AA59518; Wed, 14 Mar 2001 08:03:32 -0500 Received: from southrelay02.raleigh.ibm.com (southrelay02.raleigh.ibm.com [9.37.3.209]) by rtpmail03.raleigh.ibm.com (8.8.5/8.8.5/RTP-ral-1.1) with ESMTP id IAA23072 for ; Wed, 14 Mar 2001 08:03:35 -0500 Received: from d04nm200.raleigh.ibm.com (d04nm200.raleigh.ibm.com [9.67.228.37]) by southrelay02.raleigh.ibm.com (8.11.2/NCO v4.95) with ESMTP id f2ED3Xb30008; Wed, 14 Mar 2001 08:03:33 -0500 Importance: Normal Subject: Re: PCIMe MATCHing and more To: "Larry S. Bartz" Cc: Ron Cohen , IETF Policy WG LIST X-Mailer: Lotus Notes Release 5.0.3 (Intl) 21 March 2000 Message-Id: From: "Robert Moore" Date: Wed, 14 Mar 2001 08:10:45 -0500 X-Mimetrack: Serialize by Router on D04NM200/04/M/IBM(Release 5.0.6 |December 14, 2000) at 03/14/2001 08:03:33 AM Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: policy-owner@raleigh.ibm.com Precedence: bulk Reply-To: "Robert Moore" Larry, >I've got all nine PCIM drafts on hand. I don't see any discussion of an >enum of operator attributes in the PCIM drafts. I missed it. Where is >it? Ron was talking about an earlier draft of QPIM, not PCIM. Regards, Bob Bob Moore Advanced Design and Technology Application Integration Middleware Division IBM Software Group +1-919-254-4436 remoore@us.ibm.com From majordomo@raleigh.ibm.com Wed Mar 14 17:23:18 2001 Received: from fwns1.raleigh.ibm.com (fwns1d.raleigh.ibm.com [204.146.167.235]) by ietf.org (8.9.1a/8.9.1a) with SMTP id RAA05649 for ; Wed, 14 Mar 2001 17:23:18 -0500 (EST) Received: from rtpmail02.raleigh.ibm.com (rtpmail02.raleigh.ibm.com [9.37.172.48]) by fwns1.raleigh.ibm.com (8.9.0/8.9.0/RTP-FW-1.2) with ESMTP id RAA27586; Wed, 14 Mar 2001 17:10:04 -0500 Received: from rtpaix11.raleigh.ibm.com (rtpaix11.raleigh.ibm.com [9.37.172.4]) by rtpmail02.raleigh.ibm.com (8.8.5/8.8.5/RTP-ral-1.1) with SMTP id RAA10570; Wed, 14 Mar 2001 17:09:59 -0500 Received: by rtpaix11.raleigh.ibm.com (AIX 4.1/UCB 5.64/4.03-RAL) id AA50544; Wed, 14 Mar 2001 16:46:06 -0500 Received: from rtpmail03.raleigh.ibm.com by rtpaix11.raleigh.ibm.com (AIX 4.1/UCB 5.64/4.03-RAL) id AA45416; Wed, 14 Mar 2001 16:46:03 -0500 Received: from fwns1.raleigh.ibm.com (fwns1.raleigh.ibm.com [9.37.0.3]) by rtpmail03.raleigh.ibm.com (8.8.5/8.8.5/RTP-ral-1.1) with ESMTP id QAA13106 for ; Wed, 14 Mar 2001 16:46:08 -0500 Received: from longmail2.lboard.com ([63.109.116.89]) by fwns1.raleigh.ibm.com (8.9.0/8.9.0/RTP-FW-1.2) with ESMTP id QAA24892 for ; Wed, 14 Mar 2001 16:46:04 -0500 Received: by longmail2.lboard.com with Internet Mail Service (5.5.2650.21) id ; Wed, 14 Mar 2001 16:45:44 -0500 Message-Id: From: Ed Ellesson To: "'agenda@ietf.org'" Cc: "'policy@raleigh.ibm.com'" Subject: Policy Framework Working Group Agenda Date: Wed, 14 Mar 2001 16:45:42 -0500 Mime-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Content-Type: text/plain; charset="iso-8859-1" Sender: policy-owner@raleigh.ibm.com Precedence: bulk Reply-To: Ed Ellesson Policy Framework (policy) CHAIRS: Joel Halpern Ed Ellesson Policy Framework Agenda (Tentative) Monday, March 19 at 1530-1730 (2 hours) =============================== Agenda Bash/Intro (Chairs) 10 min PCLS Status Ryan Moats rmoats@coreon.net 20 min http://www.ietf.org/internet-drafts/draft-ietf-policy-core-schema-09.txt QDDIM Status and Issues Bob Moore remoore@us.ibm.com 20 min http://www.ietf.org/internet-drafts/draft-ietf-policy-qos-device-info-model- 02.txt PCIMe Status and Issues Bob Moore remoore@us.ibm.com 60 min. (Part One) http://www.ietf.org/internet-drafts/draft-ietf-policy-pcim-ext-00.txt Recap/Summary (Chairs) 10 min Wednesday, March 21 at 0900-1130 (2.5 hours) =================================== Agenda Re-Bash/Recap (Chairs) 5 min PCIMe (Continued) Bob Moore remoore@us.ibm.com 40 min. (Part Two) http://www.ietf.org/internet-drafts/draft-ietf-policy-pcim-ext-00.txt QPIM Status and Issues Ron Cohen ronc@ntear.com 20 min http://www.ietf.org/internet-drafts/draft-ietf-policy-qos-info-model-02.txt IPSec Policy Update/Issues Lee Rafalow rafalow@raleigh.ibm.com 20 min (This is a report from the ipsp working group) http://www.ietf.org/internet-drafts/draft-ietf-ipsp-config-policy-model-02.t xt PP VPN Issues? M. Iyer? mahadevan.iyer@ind.alcatel.com 20 min (This is proposed as fyi. It is not a chartered item for our wg.) http://www.ietf.org/internet-drafts/draft-iyer-ipvpn-infomodel-req-00.txt http://www.ietf.org/internet-drafts/draft-iyer-ipvpn-infomodel-00.txt Terminology Status/Issues Andrea Westerinen andreaw@cisco.com 20 min http://www.ietf.org/internet-drafts/draft-ietf-policy-terminology-02.txt Recap/Summary (Chairs) 25 min Ed Ellesson From majordomo@raleigh.ibm.com Wed Mar 14 17:51:08 2001 Received: from fwns1.raleigh.ibm.com (fwns1d.raleigh.ibm.com [204.146.167.235]) by ietf.org (8.9.1a/8.9.1a) with SMTP id RAA05946 for ; Wed, 14 Mar 2001 17:51:06 -0500 (EST) Received: from rtpmail02.raleigh.ibm.com (rtpmail02.raleigh.ibm.com [9.37.172.48]) by fwns1.raleigh.ibm.com (8.9.0/8.9.0/RTP-FW-1.2) with ESMTP id RAA24700; Wed, 14 Mar 2001 17:44:35 -0500 Received: from rtpaix11.raleigh.ibm.com (rtpaix11.raleigh.ibm.com [9.37.172.4]) by rtpmail02.raleigh.ibm.com (8.8.5/8.8.5/RTP-ral-1.1) with SMTP id RAA19794; Wed, 14 Mar 2001 17:44:33 -0500 Received: by rtpaix11.raleigh.ibm.com (AIX 4.1/UCB 5.64/4.03-RAL) id AA62036; Wed, 14 Mar 2001 11:53:57 -0500 Received: from rtpmail01.raleigh.ibm.com by rtpaix11.raleigh.ibm.com (AIX 4.1/UCB 5.64/4.03-RAL) id AA36852; Wed, 14 Mar 2001 11:53:38 -0500 Received: from lmr (dyn9-37-49-17.raleigh.ibm.com [9.37.49.17]) by rtpmail01.raleigh.ibm.com (8.8.5/8.8.5/RTP-ral-1.1) with SMTP id LAA34324 for ; Wed, 14 Mar 2001 11:53:16 -0500 Message-Id: <005201c0aca6$e0ef4660$11312509@raleigh.ibm.com> From: "Lee Rafalow" To: References: <3AAE4BD4.DE8AFACA@parnelli.indy.cr.irs.gov> Subject: Re: PCIMe MATCHing and more Date: Wed, 14 Mar 2001 11:50:23 -0500 Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-Msmail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4522.1200 X-Mimeole: Produced By Microsoft MimeOLE V5.50.4522.1200 Sender: policy-owner@raleigh.ibm.com Precedence: bulk Reply-To: "Lee Rafalow" Content-Transfer-Encoding: 7bit For applications of the policy framework to any text evaluating policies (e.g., web), regular expressions will be very useful. See, for example, http://www.ietf.org/internet-drafts/draft-beck-opes-irml-00.txt Lee M. Rafalow Voice: 1-919-254-4455; Fax: 1-919-254-6243 IBM Internet Technology Management IBM Corporation P.O. Box 12195, BRQA/502 RTP, NC 27709 USA Alternate email: rafalow@us.ibm.com Home email: rafalow@mindspring.com ----- Original Message ----- From: "Larry S. Bartz" To: "Ron Cohen" Cc: "IETF Policy WG LIST" Sent: Tuesday, March 13, 2001 11:33 AM Subject: Re: PCIMe MATCHing and more > Ron Cohen wrote: > > > > Larry, > > > > I understand that we could have adopted a regular expression approach. > > > The explicit condition types which I described provide for all of the > comparison operations. When we combine these with rfc3060's CNF, > DNF, and negation facilities, we have a capability to compose complex > condition specs from a well-defined, relatively small set of granular > condition objects. I meant *this* to be the focus of my approach. If > my message gave the impression that "regular expression" was the > focus, my bad. > > The use of regular expression syntax is not a premiere feature of > the strategy I've described. The use of regular expressions in > conditions > should be only in the rare, exceptional cases. It is there as an escape > hatch for cases I couldn't imagine yet. The recommendation of ecma262 > was simply to avoid requiring anyone to invent their own escape hatch. > Further, it avoids requiring everyone to be able to recognize and > negotiate everybody else's funky (or sublime) homemade escape hatches. > > > > But, > > I'm not sure that I understand what is wrong with the current approach. What > > is wrong with an IPv4address Value that specify both an address and an > > address and mask using a semantic convention? > > > If you can't determine the semantic of a variable unless and until > you evaluate an instance value which is assigned to that variable, > then you've got an ambiguous semantic. This might be fine under tightly > controlled implementations; implementations under which all interpreters > agree that they'll accept and comprehend "one of these" or "one of > those" > or "any one of these five kinds". > > But I don't think this is an appropriate strategy to promote and > canonize > as a strategy of a "core" information model. It's not reusable enough, > not generalizable enough to be called "core". > > > > Please give an example for > > your statement "PCIMe specification of context sensitive inference of > > MATCHing semantics for policy conditions implies a potential that the > > correct inference might not be drawn", and show how your proposal solves > > this ambiguity. > > > I intend not to resolve ambiguity, but to avoid ambiguity. > > The last paragraph of PCIMe 4.8.3 reveals the weakness I intended > to address in my proposal. I'll paraphrase: > > "The "If" term and the "MATCH" operator are not directly modeled -- > they are implied." > > and > > "Text accompanying the value class definition SHOULD be used as a > guideline for interpreting the semantics of the MATCH relationship." > > By PCIMe's definition, an implementation cannot explicitly identify > exactly what MATCH means. PCIMe resorts to unstructured and unparseable > text as a guideline. > > There is a an arguably finite set of distinct and explicitly-defineable > MATCH terms. I've laid 'em out. There aren't that many. It's easier to > avoid ambiguity than it is to resolve it. > > > > > > The ability to define ranges of integers without including them within a > > condition is to enable to reuse them with different variables. That is, the > > range 1000-1024 can specify a port range that can be used within a condition > > that checks this range against a source-port or a destination-port variable. > > How do you suggest to do that within your proposal? > > > I wouldn't reuse the integer values. I would reuse the conditions. This > follows the strategy of rfc3060. I would specify two reusable condition > instances of greaterThanOrEqualConditionSelector and > lessThanOrEqualConditionSelector. These two could be components of a > reusable conditionList. Or each could be reusable, on its own, without > regard for the other. > > > > > > Your propsal to define an explictcomparatorcondition resembles what we had > > several drafts ago, where we had an operator attribute within simple > > condition that had enum values of equal, greater than, etc. We moved from > > this proposal to the current one to allow support mentioned in the previous > > point as well as other reasons. Possibly we did a mistake there, and we > > should reconsider. But we need good reasons for that, which I don't see at > > the moment. > > > I've got all nine PCIM drafts on hand. I don't see any discussion of an > enum of operator attributes in the PCIM drafts. I missed it. Where is > it? > > > If Lee Rafalow is right, if PCIMe should withdraw from this procedural > direction, I'll be just as happy. I think that what I've described *is* > a "table-driven decision system" (to quote Lee) which conforms to the > letter and the spirit of rfc3060. I agree with Lee's assertion that > PCIMe is something else. If what I've described is nothing more than > an rfc3060-conformant local implementation, fine by me. > > > Explicitly yours, > Larry > > > > > > Thanks > > Ron > > > > > -----Original Message----- > > > From: policy-owner@raleigh.ibm.com > > > [mailto:policy-owner@raleigh.ibm.com]On Behalf Of Larry S. Bartz > > > Sent: Saturday, March 10, 2001 12:20 AM > > > To: IETF Policy WG LIST > > > Subject: PCIMe MATCHing and more > > > > > > > > > PCIMe's specification of context-sensitive inference of MATCHing > > > semantics for policy conditions implies a potential that the correct > > > inference might not be drawn. Unless the schema designer, the > > > information infrastructure architect, and the policy-interpreting > > > code designer/programmer are one-in-the-same, there's a lot of > > > space between the rubber and the road. > > > > > > There may be a mechanism by which the MATCHing semantic can be made > > > explicit. I'm suggesting such a mechanism, in which subtypes of > > > policyConditionAuxClass are named for the particular comparison > > > semantic they support. Use of these subtypes can constitute a > > > semantic contract which binds the designer, implementor, and user > > > to a model of usage which is unambiguous. > > > > > > As with policyCondition's MATCH semantic, policyAction's "set" > > > semantic could be augmented. Unless one accepts the limitation of a > > > simple assignment operation, "set" requires context-sensitive > > > inference, just as condition's MATCH does. > > > > > > There may be a mechanism by which the "set" semantic of policyAction > > > can be made explicit. I'm suggesting such a mechanism, in which > > > subtypes of policyActionAuxClass are named for the particular > > > assignment operation they support. Use of these subtypes can constitute > > > a semantic contract which binds the designer, implementor, and user > > > to a model of usage which is unambiguous. > > > > > > In section 5.14, PCIMe invents syntaxes for complex expressions of > > > several types of value criteria. These inventions will require > > > implementors to likewise invent corresponding custom code. > > > > > > If the MATCHing semantics of conditions are made explicit, some of > > > the syntactical constructs of PCIMe 5.14 are not necessary. For > > > example, expresssions of value ranges can be accomplished by > > > CNF'd granular policy conditions of the explicit types described > > > here. > > > > > > There may yet be cases in which combinations of granular conditions > > > cannot suffice, even when augmented by PCIM's CNF, DNF, and negation > > > facilities. These cases might inspire the invention of syntax, > > > semantics, and grammar as tools which can express and interpret > > > complex information. > > > > > > Why invent such tools when they're already available? Rather than > > > invent, the model described here capitalizes upon the regular > > > expression syntax of the ECMA262 specification. ECMA262 regExp > > > is richly expressive and platform-neutral. Everybody has an ECMA262 > > > interpreter on their desktop, laptop, and (some) elsewhere. > > > > > > The objectclasses and attributetypes described below are named in terms > > > of "selector" (conditions) and "setter" (actions). These terms are not > > > part of rfc3060's lexicon. I use these terms for these specific types > > > simply to differentiate them from any others. > > > > > > I've described these in the ABNF, which is the usual form of expression > > > for Directory schema. I realize that the PCIMe draft is not a schema > > > proposal, and that the ABNF is not the usual form of expression for > > > Policy WG drafts which are not explicitly about implementation of > > > Policy in the Directory. Forgive me. I'm a little Directory-centric. > > > I hope Policy WG's members have seen and digested enough ABNF by now, > > > so that what I'm describing is more or less obvious. > > > > > > Your comments are most welcome. If you think this has merit but needs > > > work, please say so. If you think it's tripe, say that, too. > > > > > > Long lines are folded, to enhance readability. > > > > > > ##### policy condition stuff > > > > > > objectclass ( oid-oc.X > > > NAME 'selectorPolicyConditionAssociation' > > > DESC 'selectorPolicyCondition is AUXed by subtypes of > > > policyConditionSelector.' > > > SUP policyRuleConditionAssociation > > > STRUCTURAL > > > MUST cn > > > ) > > > > > > attributetype ( oid-at.X > > > NAME 'selectorAttributeOID' > > > DESC 'Value(s) of this attribute of the candidate object are evaluated > > > for selection.' > > > SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 > > > EQUALITY objectIdentifierMatch > > > SINGLE-VALUE > > > USAGE userApplications > > > ) > > > > > > attributetype ( oid-at.X > > > NAME 'selectorPropertyName' > > > DESC 'Value(s) of this property of the application environment are > > > evaluated for selection.' > > > SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 > > > EQUALITY caseIgnoreMatch > > > SUBSTR caseIgnoreSubstringsMatch > > > SINGLE-VALUE > > > USAGE userApplications > > > ) > > > > > > objectclass ( oid-oc.X > > > NAME 'policyConditionSelector' > > > DESC 'Several subtypes of this are used to implement explicit selection > > > semantics by comparing the value of a candidate attribute/value pair > > > or property/value pair to the value of selector criteria. Instances of > > > this SHALL include either selectorAttributeOID attribute/value pair or > > > selectorPropertyName attribute/value pair, but NEVER BOTH.' > > > SUP policyConditionAuxClass > > > AUXILIARY > > > MAY ( selectorAttributeOID $ selectorPropertyName ) > > > ) > > > > > > attributetype ( oid-at.X > > > NAME 'selectorValue' > > > DESC 'Candidate value of selectorAttributeOID or selectorPropertyName > > > is evaluated for selection against the value of this, which constitutes > > > the selection criteria.' > > > SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 > > > EQUALITY caseIgnoreMatch > > > SUBSTR caseIgnoreSubstringsMatch > > > USAGE userApplications > > > ) > > > > > > objectclass ( oid-oc.X > > > NAME 'explicitComparatorConditionSelector' > > > DESC 'subtypes of this support various explicit semantics for > > > evaluating > > > a candidate value against selection criteria. Never create instances > > > of this. ONLY create instances of subtypes of this.' > > > SUP policyConditionSelector > > > AUXILIARY > > > MUST selectorValue > > > ) > > > > > > objectclass ( oid-oc.X > > > NAME 'equalConditionSelector' > > > DESC 'Represents selection according to the semantic of "equal". The > > > candidate value is tested for "equal" with respect to the selection > > > criteria.' > > > SUP explicitComparatorConditionSelector > > > AUXILIARY > > > ) > > > > > > objectclass ( oid-oc.X > > > NAME 'greaterThanConditionSelector' > > > DESC 'Represents selection according to the semantic of > > > "greaterThan". The candidate value is tested for "greaterThan" with > > > respect to the selection criteria.' > > > SUP explicitComparatorConditionSelector > > > AUXILIARY > > > ) > > > > > > objectclass ( oid-oc.X > > > NAME 'lessThanConditionSelector' > > > DESC 'Represents selection according to the semantic of "lessThan". The > > > candidate value is tested for "lessThan" with respect to the selection > > > criteria.' > > > SUP explicitComparatorConditionSelector > > > AUXILIARY > > > ) > > > > > > objectclass ( oid-oc.X > > > NAME 'greaterThanOrEqualConditionSelector' > > > DESC 'Represents selection according to the semantic of > > > "greaterThanOrEqual". The candidate value is tested for > > > "greaterThanOrEqual" with respect to the selection criteria.' > > > SUP explicitComparatorConditionSelector > > > AUXILIARY > > > ) > > > > > > objectclass ( oid-oc.X > > > NAME 'lessThanOrEqualConditionSelector' > > > DESC 'Represents selection according to the semantic of > > > "lessThanOrEqual". The candidate value is tested for "lessThanOrEqual" > > > with respect to the selection criteria.' > > > SUP explicitComparatorConditionSelector > > > AUXILIARY > > > ) > > > > > > objectclass ( oid-oc.X > > > NAME 'beginsWithConditionSelector' > > > DESC 'Represents selection according to the semantic of "beginsWith". > > > The > > > candidate value is tested for "beginsWith" with respect to the > > > selection > > > criteria.' > > > SUP explicitComparatorConditionSelector > > > AUXILIARY > > > ) > > > > > > objectclass ( oid-oc.X > > > NAME 'endsWithConditionSelector' > > > DESC 'Represents selection according to the semantic of "endsWith". The > > > candidate value is tested for "endsWith" with respect to the selection > > > criteria.' > > > SUP explicitComparatorConditionSelector > > > AUXILIARY > > > ) > > > > > > objectclass ( oid-oc.X > > > NAME 'containsConditionSelector' > > > DESC 'Represents selection according to the semantic of "contains". The > > > candidate value is tested for "contains" with respect to the selection > > > criteria.' > > > SUP explicitComparatorConditionSelector > > > AUXILIARY > > > ) > > > > > > objectclass ( oid-oc.X > > > NAME 'existsConditionSelector' > > > DESC 'Represents selection according to the semantic of "exists". The > > > candidate value is tested for "exists". The selection criteria is > > > superfluous in this comparison.' > > > SUP explicitComparatorConditionSelector > > > AUXILIARY > > > ) > > > > > > objectclass ( oid-oc.X > > > NAME 'bitwiseANDConditionSelector' > > > DESC 'Represents selection according to the semantic of "bitwiseAND". > > > The > > > candidate value is tested for "bitwiseAND" with respect to the > > > selection > > > criteria.' > > > SUP explicitComparatorConditionSelector > > > AUXILIARY > > > ) > > > > > > objectclass ( oid-oc.X > > > NAME 'bitwiseINclusiveORConditionSelector' > > > DESC 'Represents selection according to the semantic of > > > "bitwiseINclusiveOR". The candidate value is tested for > > > "bitwiseINclusiveOR" with respect to the selection criteria.' > > > SUP explicitComparatorConditionSelector > > > AUXILIARY > > > ) > > > > > > objectclass ( oid-oc.X > > > NAME 'bitwiseEXclusiveORConditionSelector' > > > DESC 'Represents selection according to the semantic of > > > "bitwiseEXclusiveOR". The candidate value is tested for > > > "bitwiseEXclusiveOR" with respect to the selection criteria.' > > > SUP explicitComparatorConditionSelector > > > AUXILIARY > > > ) > > > > > > objectclass ( oid-oc.X > > > NAME 'onesComplementConditionSelector' > > > DESC 'Represents selection according to the semantic of > > > "onesComplement". The candidate value is tested for "onesComplement". > > > The > > > selection criteria is superfluous in this comparison.' > > > SUP explicitComparatorConditionSelector > > > AUXILIARY > > > ) > > > > > > attributetype ( oid-at.X > > > NAME 'selectorEcma262regExp' > > > DESC 'Candidate value of selectorAttributeOID or selectorPropertyName > > > is evaluated for selection against the ecma262 regular expression which > > > is the value of this. See http://www.ecma.ch/ecma1/stand/ecma-262.htm' > > > SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 > > > EQUALITY caseIgnoreMatch > > > SUBSTR caseIgnoreSubstringsMatch > > > USAGE userApplications > > > ) > > > > > > objectclass ( oid-oc.X > > > NAME 'ecma262regExpConditionSelector' > > > DESC 'ecma262regExpConditionSelector supports the semantic of > > > evaluating > > > a candidate value against an ecma262 regular expression.' > > > SUP policyConditionSelector > > > AUXILIARY > > > MUST selectorEcma262regExp > > > ) > > > > > > # policy action stuff > > > > > > objectclass ( oid-oc.X > > > NAME 'setterPolicyActionAssociation' > > > DESC 'setterPolicyAction is AUXed by subtypes of policyActionSetter.' > > > SUP policyRuleActionAssociation > > > STRUCTURAL > > > MUST cn > > > ) > > > > > > attributetype ( oid-at.X > > > NAME 'propertyNameToSet' > > > DESC 'Value of this property of the application environment is set or > > > modified by the action.' > > > SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 > > > EQUALITY caseIgnoreMatch > > > SUBSTR caseIgnoreSubstringsMatch > > > USAGE userApplications > > > ) > > > > > > objectclass ( oid-oc.X > > > NAME 'policyActionSetter' > > > DESC 'several subtypes of this implement explicit semantics for setting > > > or modifying the value of an application-defined, application-dependent > > > property.' > > > SUP policyActionAuxClass > > > AUXILIARY > > > MUST propertyNameToSet > > > ) > > > > > > attributetype ( oid-at.X > > > NAME 'setToValue' > > > DESC 'The value of a property of the application environment is set to > > > or modified by the value of this, which constitutes the value setting > > > criteria.' > > > SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 > > > EQUALITY caseIgnoreMatch > > > SUBSTR caseIgnoreSubstringsMatch > > > USAGE userApplications > > > ) > > > > > > objectclass ( oid-oc.X > > > NAME 'assignmentOperatorActionSetter' > > > DESC 'subtypes of this support various semantics of setting a candidate > > > value according to value setting criteria. Never create instances of > > > this. ONLY create instances of subtypes of this.' > > > SUP policyActionSetter > > > AUXILIARY > > > MUST setToValue > > > ) > > > > > > objectclass ( oid-oc.X > > > NAME 'setEqualToAssignmentOperatorActionSetter' > > > DESC 'Represents value assignment according to the semantic of > > > "setEqualTo". The value of the candidate property is assigned or > > > modified > > > by "setEqualTo" with respect to the value setting criteria.' > > > SUP assignmentOperatorActionSetter > > > AUXILIARY > > > ) > > > > > > objectclass ( oid-oc.X > > > NAME 'setPlusEqualToAssignmentOperatorActionSetter' > > > DESC 'Represents value assignment according to the semantic of > > > "setPlusEqualTo". The value of the candidate property is assigned or > > > modified by "setPlusEqualTo" with respect to the value setting > > > criteria.' > > > SUP assignmentOperatorActionSetter > > > AUXILIARY > > > ) > > > > > > objectclass ( oid-oc.X > > > NAME 'setMinusEqualToAssignmentOperatorActionSetter' > > > DESC 'Represents value assignment according to the semantic of > > > "setMinusEqualTo". The value of the candidate property is assigned > > > or modified by "setMinusEqualTo" with respect to the value setting > > > criteria.' > > > SUP assignmentOperatorActionSetter > > > AUXILIARY > > > ) > > > > > > objectclass ( oid-oc.X > > > NAME 'setMultEqualToAssignmentOperatorActionSetter' > > > DESC 'Represents value assignment according to the semantic of > > > "setMultEqualTo". The value of the candidate property is assigned or > > > modified by "setMultEqualTo" with respect to the value setting > > > criteria.' > > > SUP assignmentOperatorActionSetter > > > AUXILIARY > > > ) > > > > > > objectclass ( oid-oc.X > > > NAME 'setDivEqualToAssignmentOperatorActionSetter' > > > DESC 'Represents value assignment according to the semantic of > > > "setDivEqualTo". The value of the candidate property is assigned or > > > modified by "setDivEqualTo" with respect to the value setting > > > criteria.' > > > SUP assignmentOperatorActionSetter > > > AUXILIARY > > > ) > > > > > > objectclass ( oid-oc.X > > > NAME 'setModuloEqualToAssignmentOperatorActionSetter' > > > DESC 'Represents value assignment according to the semantic of > > > "setModuloEqualTo". The value of the candidate property is assigned > > > or modified by "setModuloEqualTo" with respect to the value setting > > > criteria.' > > > SUP assignmentOperatorActionSetter > > > AUXILIARY > > > ) > > > > > > objectclass ( oid-oc.X > > > NAME 'setShiftLeftByAssignmentOperatorActionSetter' > > > DESC 'Represents value assignment according to the semantic of > > > "setShiftLeftBy". The value of the candidate property is assigned or > > > modified by "setShiftLeftBy" with respect to the value setting > > > criteria.' > > > SUP assignmentOperatorActionSetter > > > AUXILIARY > > > ) > > > > > > objectclass ( oid-oc.X > > > NAME 'setShiftRightByAssignmentOperatorActionSetter' > > > DESC 'Represents value assignment according to the semantic of > > > "setShiftRightBy". The value of the candidate property is assigned > > > or modified by "setShiftRightBy" with respect to the value setting > > > criteria.' > > > SUP assignmentOperatorActionSetter > > > AUXILIARY > > > ) > > > > > > objectclass ( oid-oc.X > > > NAME 'setBitwiseANDwithAssignmentOperatorActionSetter' > > > DESC 'Represents value assignment according to the semantic of > > > "setBitwiseANDwith". The value of the candidate property is assigned > > > or modified by "setBitwiseANDwith" with respect to the value setting > > > criteria.' > > > SUP assignmentOperatorActionSetter > > > AUXILIARY > > > ) > > > > > > objectclass ( oid-oc.X > > > NAME 'setBitwiseINclusiveORwithAssignmentOperatorActionSetter' > > > DESC 'Represents value assignment according to the semantic of > > > "setBitwiseINclusiveORwith". The value of the candidate property is > > > assigned or modified by "setBitwiseINclusiveORwith" with respect to > > > the value setting criteria.' > > > SUP assignmentOperatorActionSetter > > > AUXILIARY > > > ) > > > > > > objectclass ( oid-oc.X > > > NAME 'setBitwiseEXclusiveORwithAssignmentOperatorActionSetter' > > > DESC 'Represents value assignment according to the semantic of > > > "setBitwiseEXclusiveORwith". The value of the candidate property is > > > assigned or modified by "setBitwiseEXclusiveORwith" with respect to > > > the value setting criteria.' > > > SUP assignmentOperatorActionSetter > > > AUXILIARY > > > ) > > > > > > objectclass ( oid-oc.X > > > NAME 'setOnesComplementAssignmentOperatorActionSetter' > > > DESC 'Represents value assignment according to the semantic of > > > "setOnesComplement". The value of the candidate property is assigned > > > or modified by "setOnesComplement". The value setting criteria is > > > superfluous in this operation.' > > > SUP assignmentOperatorActionSetter > > > AUXILIARY > > > ) > > > > > > attributetype ( oid-at.X > > > NAME 'setToEcma262regExp' > > > DESC 'The value of a property of the application environment is > > > set or modified according to an evaluation of this ecma262 regular > > > expression. See http://www.ecma.ch/ecma1/stand/ecma-262.htm' > > > SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 > > > EQUALITY caseIgnoreMatch > > > SUBSTR caseIgnoreSubstringsMatch > > > USAGE userApplications > > > ) > > > > > > objectclass ( oid-oc.X > > > NAME 'ecma262regExpActionSetter' > > > DESC 'ecma262regExpActionSetter supports the semantic of setting > > > a candidate value according to the evaluation an ecma262 regular > > > expression.' > > > SUP policyActionSetter > > > AUXILIARY > > > MUST setToEcma262regExp > > > ) > > > > > -- > #::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::| > # Larry Bartz | | > # lbartz@parnelli.indy.cr.irs.gov | Ooo, ooo, | > # | Ooo, ooo, oooooo! | > # | I've got a gnu attitude! | > # voice (317) 226-7060 | | > # FAX (317) 226-6378 | | > #::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::| From majordomo@raleigh.ibm.com Tue Mar 20 08:50:20 2001 Received: from fwns1.raleigh.ibm.com (fwns1d.raleigh.ibm.com [204.146.167.235]) by ietf.org (8.9.1a/8.9.1a) with SMTP id IAA05893 for ; Tue, 20 Mar 2001 08:50:20 -0500 (EST) Received: from rtpmail01.raleigh.ibm.com (rtpmail01.raleigh.ibm.com [9.37.172.24]) by fwns1.raleigh.ibm.com (8.9.0/8.9.0/RTP-FW-1.2) with ESMTP id IAA08192; Tue, 20 Mar 2001 08:40:21 -0500 Received: from rtpaix11.raleigh.ibm.com (rtpaix11.raleigh.ibm.com [9.37.172.4]) by rtpmail01.raleigh.ibm.com (8.8.5/8.8.5/RTP-ral-1.1) with SMTP id IAA26872; Tue, 20 Mar 2001 08:40:19 -0500 Received: by rtpaix11.raleigh.ibm.com (AIX 4.1/UCB 5.64/4.03-RAL) id AA37676; Tue, 20 Mar 2001 08:07:15 -0500 Received: from rtpmail03.raleigh.ibm.com by rtpaix11.raleigh.ibm.com (AIX 4.1/UCB 5.64/4.03-RAL) id AA37794; Tue, 20 Mar 2001 08:07:08 -0500 Received: from fwns1.raleigh.ibm.com (fwns1.raleigh.ibm.com [9.37.0.3]) by rtpmail03.raleigh.ibm.com (8.8.5/8.8.5/RTP-ral-1.1) with ESMTP id IAA34510 for ; Tue, 20 Mar 2001 08:07:09 -0500 Received: from smtp2.cluster.oleane.net (smtp2.cluster.oleane.net [195.25.12.17]) by fwns1.raleigh.ibm.com (8.9.0/8.9.0/RTP-FW-1.2) with ESMTP id IAA29632 for ; Tue, 20 Mar 2001 08:07:06 -0500 Received: from oleane (dyn-1-1-134.Vin.dialup.oleane.fr [195.25.4.134]) by smtp2.cluster.oleane.net with SMTP id f2KD76f30861 for ; Tue, 20 Mar 2001 14:07:06 +0100 (CET) Message-Id: <005101c0b13e$9fbfa6c0$8001a8c0@oleane.com> From: "Peter Lewis" To: Subject: IP Policy Conference: call for proposals Date: Tue, 20 Mar 2001 14:06:48 +0100 Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_004E_01C0B147.01302260" X-Priority: 3 X-Msmail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2314.1300 X-Mimeole: Produced By Microsoft MimeOLE V5.00.2314.1300 Sender: policy-owner@raleigh.ibm.com Precedence: bulk Reply-To: "Peter Lewis" This is a multi-part message in MIME format. ------=_NextPart_000_004E_01C0B147.01302260 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable How will policies encourage the creation of new services?=20 Which services need resort to policy management? SNMPconf, COPS, SNMPV3 issues : the second edition of IP Policy will be = organized in Paris next September 11-14. A call for proposals is online at: http://www.upperside.fr/ippol01/ippolcfp.htm ------=_NextPart_000_004E_01C0B147.01302260 Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable
How will policies encourage = the creation=20 of new services?
Which=20 services need resort to policy management?
SNMPconf, COPS, SNMPV3 issues : the = second=20 edition of IP Policy will be organized in Paris next September=20 11-14.
A call for = proposals is=20 online at:
http://www.uppersid= e.fr/ippol01/ippolcfp.htm
 
 
------=_NextPart_000_004E_01C0B147.01302260-- From majordomo@raleigh.ibm.com Tue Mar 20 09:29:55 2001 Received: from fwns1.raleigh.ibm.com (fwns1d.raleigh.ibm.com [204.146.167.235]) by ietf.org (8.9.1a/8.9.1a) with SMTP id JAA07270 for ; Tue, 20 Mar 2001 09:29:54 -0500 (EST) Received: from rtpmail02.raleigh.ibm.com (rtpmail02.raleigh.ibm.com [9.37.172.48]) by fwns1.raleigh.ibm.com (8.9.0/8.9.0/RTP-FW-1.2) with ESMTP id JAA09614; Tue, 20 Mar 2001 09:20:11 -0500 Received: from rtpaix11.raleigh.ibm.com (rtpaix11.raleigh.ibm.com [9.37.172.4]) by rtpmail02.raleigh.ibm.com (8.8.5/8.8.5/RTP-ral-1.1) with SMTP id JAA31894; Tue, 20 Mar 2001 09:20:06 -0500 Received: by rtpaix11.raleigh.ibm.com (AIX 4.1/UCB 5.64/4.03-RAL) id AA34802; Tue, 20 Mar 2001 08:55:40 -0500 Received: from rtpmail03.raleigh.ibm.com by rtpaix11.raleigh.ibm.com (AIX 4.1/UCB 5.64/4.03-RAL) id AA38634; Tue, 20 Mar 2001 08:55:37 -0500 Received: from fwns2.raleigh.ibm.com (fwns2.raleigh.ibm.com [9.37.0.4]) by rtpmail03.raleigh.ibm.com (8.8.5/8.8.5/RTP-ral-1.1) with ESMTP id IAA33348 for ; Tue, 20 Mar 2001 08:55:38 -0500 Received: from roam.psg.com (root@pcp000682pcs.wireless.meeting.ietf.org [135.222.64.182]) by fwns2.raleigh.ibm.com (8.9.0/8.9.0/RTP-FW-1.2) with ESMTP id IAA23596 for ; Tue, 20 Mar 2001 08:55:34 -0500 Received: from randy by roam.psg.com with local (Exim 3.20 #1) id 14fMbg-0002xP-00; Tue, 20 Mar 2001 07:55:28 -0600 From: Randy Bush Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit To: "Peter Lewis" Cc: Subject: Re: IP Policy Conference: call for proposals References: <005101c0b13e$9fbfa6c0$8001a8c0@oleane.com> Message-Id: Date: Tue, 20 Mar 2001 07:55:28 -0600 Sender: policy-owner@raleigh.ibm.com Precedence: bulk Reply-To: Randy Bush Content-Transfer-Encoding: 7bit > How will policies encourage the creation of new services? > Which services need resort to policy management? mailing lists, to prevent slimy spammers. From majordomo@raleigh.ibm.com Thu Mar 29 08:18:59 2001 Received: from fwns1.raleigh.ibm.com (fwns1d.raleigh.ibm.com [204.146.167.235]) by ietf.org (8.9.1a/8.9.1a) with SMTP id IAA13338 for ; Thu, 29 Mar 2001 08:18:58 -0500 (EST) Received: from rtpmail01.raleigh.ibm.com (rtpmail01.raleigh.ibm.com [9.37.172.24]) by fwns1.raleigh.ibm.com (8.9.0/8.9.0/RTP-FW-1.2) with ESMTP id IAA21348; Thu, 29 Mar 2001 08:04:49 -0500 Received: from rtpaix11.raleigh.ibm.com (rtpaix11.raleigh.ibm.com [9.37.172.4]) by rtpmail01.raleigh.ibm.com (8.8.5/8.8.5/RTP-ral-1.1) with SMTP id IAA35556; Thu, 29 Mar 2001 08:02:24 -0500 Received: by rtpaix11.raleigh.ibm.com (AIX 4.1/UCB 5.64/4.03-RAL) id AA50492; Thu, 29 Mar 2001 07:29:59 -0500 Received: from rtpmail03.raleigh.ibm.com by rtpaix11.raleigh.ibm.com (AIX 4.1/UCB 5.64/4.03-RAL) id AB50472; Thu, 29 Mar 2001 07:29:51 -0500 Received: from fwns2.raleigh.ibm.com (fwns2.raleigh.ibm.com [9.37.0.4]) by rtpmail03.raleigh.ibm.com (8.8.5/8.8.5/RTP-ral-1.1) with ESMTP id HAA23402; Thu, 29 Mar 2001 07:29:55 -0500 Received: from mx-relay2.treas.gov (mx-relay2.treas.gov [199.196.144.6]) by fwns2.raleigh.ibm.com (8.9.0/8.9.0/RTP-FW-1.2) with ESMTP id HAA16454; Thu, 29 Mar 2001 07:29:53 -0500 Received: from tias4.treas.gov (tias-gw4.treas.gov [199.196.144.14]) by mx-relay2.treas.gov (8.9.1b+Sun/8.9.3) with SMTP id HAA11154; Thu, 29 Mar 2001 07:29:49 -0500 (EST) Received: from mailhub.net.treas.gov by tias4.treas.gov via smtpd (for mx-relay.treas.gov [199.196.144.6]) with SMTP; 29 Mar 2001 12:29:49 UT Received: from mears.indy.cr.irs.gov (mailhub-3 [10.7.8.11]) by mailhub-3.net.treas.gov (8.9.3+Sun/8.9.3) with ESMTP id HAA11524; Thu, 29 Mar 2001 07:26:45 -0500 (EST) Received: from parnelli.indy.cr.irs.gov (IDENT:lsbart35@localhost [127.0.0.1]) by mears.indy.cr.irs.gov (8.9.3/8.9.3) with ESMTP id HAA01572; Thu, 29 Mar 2001 07:29:41 -0500 Message-Id: <3AC32AB5.ECD19A46@parnelli.indy.cr.irs.gov> Date: Thu, 29 Mar 2001 07:29:41 -0500 From: "Larry S. Bartz" X-Mailer: Mozilla 4.72 [en] (X11; U; Linux 2.2.14-5.0smp i686) X-Accept-Language: en Mime-Version: 1.0 To: IETF Policy WG LIST , Lee Rafalow Subject: regExp spec [was: Re: PCIMe MATCHing and more] Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: policy-owner@raleigh.ibm.com Precedence: bulk Reply-To: "Larry S. Bartz" Content-Transfer-Encoding: 7bit I didn't get a copy of this back from the list, and it hasn't shown up in the lists's archives, either. -------- Original Message -------- Subject: Re: PCIMe MATCHing and more Date: Wed, 28 Mar 2001 08:27:41 -0500 From: "Larry S. Bartz" To: Lee Rafalow ,IETF Policy WG LIST References: <3AAE4BD4.DE8AFACA@parnelli.indy.cr.irs.gov> <005201c0aca6$e0ef4660$11312509@raleigh.ibm.com> Lee Rafalow wrote: > > For applications of the policy framework to any text evaluating policies > (e.g., web), regular expressions will be very useful. > > See, for example, > http://www.ietf.org/internet-drafts/draft-beck-opes-irml-00.txt > I agree, Lee. That draft cites POSIX (ISO/IEC DIS 9945-2:1992 and IEEE Std 1003.2-1992) as the spec for regular expressions. In my message, I cited ECMA262 (aka ISO-16262, aka ECMAscript, aka JavaScript) as the spec for regular expressions. The ISO-16262 regular expression syntax is directly supported in web browser software and in readily available implementations of server-side ECMAscript. It can be parsed and interpreted practically anywhere. In addition, the ISO-16262 regular expression syntax is based upon Perl 5 regular expression syntax, which in turn has its roots in POSIX regExp, which in turn grew from C and Unix based regExp. The Perl environemt has subsequently added functionality to regExp, so that Perl-5/ECMA262/ISO-16262 regExp is a superset of POSIX regExp. While POSIX regExp is certainly a stable standard, I prefer the Perl-5/ECMA262/ISO-16262 superset, both for its enhanced capabilities and for its widespread implementation support. > Lee M. Rafalow > Voice: 1-919-254-4455; Fax: 1-919-254-6243 > IBM Internet Technology Management > IBM Corporation > P.O. Box 12195, BRQA/502 > RTP, NC 27709 USA > Alternate email: rafalow@us.ibm.com > Home email: rafalow@mindspring.com > ----- Original Message ----- > From: "Larry S. Bartz" > To: "Ron Cohen" > Cc: "IETF Policy WG LIST" > Sent: Tuesday, March 13, 2001 11:33 AM > Subject: Re: PCIMe MATCHing and more > > > Ron Cohen wrote: > > > > > > Larry, > > > > > > I understand that we could have adopted a regular expression approach. > > > > > > The explicit condition types which I described provide for all of the > > comparison operations. When we combine these with rfc3060's CNF, > > DNF, and negation facilities, we have a capability to compose complex > > condition specs from a well-defined, relatively small set of granular > > condition objects. I meant *this* to be the focus of my approach. If > > my message gave the impression that "regular expression" was the > > focus, my bad. > > > > The use of regular expression syntax is not a premiere feature of > > the strategy I've described. The use of regular expressions in > > conditions > > should be only in the rare, exceptional cases. It is there as an escape > > hatch for cases I couldn't imagine yet. The recommendation of ecma262 > > was simply to avoid requiring anyone to invent their own escape hatch. > > Further, it avoids requiring everyone to be able to recognize and > > negotiate everybody else's funky (or sublime) homemade escape hatches. > > > > > > > But, > > > I'm not sure that I understand what is wrong with the current approach. > What > > > is wrong with an IPv4address Value that specify both an address and an > > > address and mask using a semantic convention? > > > > > > If you can't determine the semantic of a variable unless and until > > you evaluate an instance value which is assigned to that variable, > > then you've got an ambiguous semantic. This might be fine under tightly > > controlled implementations; implementations under which all interpreters > > agree that they'll accept and comprehend "one of these" or "one of > > those" > > or "any one of these five kinds". > > > > But I don't think this is an appropriate strategy to promote and > > canonize > > as a strategy of a "core" information model. It's not reusable enough, > > not generalizable enough to be called "core". > > > > > > > Please give an example for > > > your statement "PCIMe specification of context sensitive inference of > > > MATCHing semantics for policy conditions implies a potential that the > > > correct inference might not be drawn", and show how your proposal > solves > > > this ambiguity. > > > > > > I intend not to resolve ambiguity, but to avoid ambiguity. > > > > The last paragraph of PCIMe 4.8.3 reveals the weakness I intended > > to address in my proposal. I'll paraphrase: > > > > "The "If" term and the "MATCH" operator are not directly modeled -- > > they are implied." > > > > and > > > > "Text accompanying the value class definition SHOULD be used as a > > guideline for interpreting the semantics of the MATCH relationship." > > > > By PCIMe's definition, an implementation cannot explicitly identify > > exactly what MATCH means. PCIMe resorts to unstructured and unparseable > > text as a guideline. > > > > There is a an arguably finite set of distinct and explicitly-defineable > > MATCH terms. I've laid 'em out. There aren't that many. It's easier to > > avoid ambiguity than it is to resolve it. > > > > > > > > > > The ability to define ranges of integers without including them within a > > > condition is to enable to reuse them with different variables. That is, > the > > > range 1000-1024 can specify a port range that can be used within a > condition > > > that checks this range against a source-port or a destination-port > variable. > > > How do you suggest to do that within your proposal? > > > > > > I wouldn't reuse the integer values. I would reuse the conditions. This > > follows the strategy of rfc3060. I would specify two reusable condition > > instances of greaterThanOrEqualConditionSelector and > > lessThanOrEqualConditionSelector. These two could be components of a > > reusable conditionList. Or each could be reusable, on its own, without > > regard for the other. > > > > > > > > > > Your propsal to define an explictcomparatorcondition resembles what we > had > > > several drafts ago, where we had an operator attribute within simple > > > condition that had enum values of equal, greater than, etc. We moved > from > > > this proposal to the current one to allow support mentioned in the > previous > > > point as well as other reasons. Possibly we did a mistake there, and we > > > should reconsider. But we need good reasons for that, which I don't see > at > > > the moment. > > > > > > I've got all nine PCIM drafts on hand. I don't see any discussion of an > > enum of operator attributes in the PCIM drafts. I missed it. Where is > > it? > > > > > > If Lee Rafalow is right, if PCIMe should withdraw from this procedural > > direction, I'll be just as happy. I think that what I've described *is* > > a "table-driven decision system" (to quote Lee) which conforms to the > > letter and the spirit of rfc3060. I agree with Lee's assertion that > > PCIMe is something else. If what I've described is nothing more than > > an rfc3060-conformant local implementation, fine by me. > > > > > > Explicitly yours, > > Larry > > > > > > > > > > Thanks > > > Ron > > > > > > > -----Original Message----- > > > > From: policy-owner@raleigh.ibm.com > > > > [mailto:policy-owner@raleigh.ibm.com]On Behalf Of Larry S. Bartz > > > > Sent: Saturday, March 10, 2001 12:20 AM > > > > To: IETF Policy WG LIST > > > > Subject: PCIMe MATCHing and more > > > > > > > > > > > > PCIMe's specification of context-sensitive inference of MATCHing > > > > semantics for policy conditions implies a potential that the correct > > > > inference might not be drawn. Unless the schema designer, the > > > > information infrastructure architect, and the policy-interpreting > > > > code designer/programmer are one-in-the-same, there's a lot of > > > > space between the rubber and the road. > > > > > > > > There may be a mechanism by which the MATCHing semantic can be made > > > > explicit. I'm suggesting such a mechanism, in which subtypes of > > > > policyConditionAuxClass are named for the particular comparison > > > > semantic they support. Use of these subtypes can constitute a > > > > semantic contract which binds the designer, implementor, and user > > > > to a model of usage which is unambiguous. > > > > > > > > As with policyCondition's MATCH semantic, policyAction's "set" > > > > semantic could be augmented. Unless one accepts the limitation of a > > > > simple assignment operation, "set" requires context-sensitive > > > > inference, just as condition's MATCH does. > > > > > > > > There may be a mechanism by which the "set" semantic of policyAction > > > > can be made explicit. I'm suggesting such a mechanism, in which > > > > subtypes of policyActionAuxClass are named for the particular > > > > assignment operation they support. Use of these subtypes can > constitute > > > > a semantic contract which binds the designer, implementor, and user > > > > to a model of usage which is unambiguous. > > > > > > > > In section 5.14, PCIMe invents syntaxes for complex expressions of > > > > several types of value criteria. These inventions will require > > > > implementors to likewise invent corresponding custom code. > > > > > > > > If the MATCHing semantics of conditions are made explicit, some of > > > > the syntactical constructs of PCIMe 5.14 are not necessary. For > > > > example, expresssions of value ranges can be accomplished by > > > > CNF'd granular policy conditions of the explicit types described > > > > here. > > > > > > > > There may yet be cases in which combinations of granular conditions > > > > cannot suffice, even when augmented by PCIM's CNF, DNF, and negation > > > > facilities. These cases might inspire the invention of syntax, > > > > semantics, and grammar as tools which can express and interpret > > > > complex information. > > > > > > > > Why invent such tools when they're already available? Rather than > > > > invent, the model described here capitalizes upon the regular > > > > expression syntax of the ECMA262 specification. ECMA262 regExp > > > > is richly expressive and platform-neutral. Everybody has an ECMA262 > > > > interpreter on their desktop, laptop, and (some) elsewhere. > > > > > > > > The objectclasses and attributetypes described below are named in > terms > > > > of "selector" (conditions) and "setter" (actions). These terms are not > > > > part of rfc3060's lexicon. I use these terms for these specific types > > > > simply to differentiate them from any others. > > > > > > > > I've described these in the ABNF, which is the usual form of > expression > > > > for Directory schema. I realize that the PCIMe draft is not a schema > > > > proposal, and that the ABNF is not the usual form of expression for > > > > Policy WG drafts which are not explicitly about implementation of > > > > Policy in the Directory. Forgive me. I'm a little Directory-centric. > > > > I hope Policy WG's members have seen and digested enough ABNF by now, > > > > so that what I'm describing is more or less obvious. > > > > > > > > Your comments are most welcome. If you think this has merit but needs > > > > work, please say so. If you think it's tripe, say that, too. > > > > > > > > Long lines are folded, to enhance readability. > > > > > > > > ##### policy condition stuff > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'selectorPolicyConditionAssociation' > > > > DESC 'selectorPolicyCondition is AUXed by subtypes of > > > > policyConditionSelector.' > > > > SUP policyRuleConditionAssociation > > > > STRUCTURAL > > > > MUST cn > > > > ) > > > > > > > > attributetype ( oid-at.X > > > > NAME 'selectorAttributeOID' > > > > DESC 'Value(s) of this attribute of the candidate object are > evaluated > > > > for selection.' > > > > SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 > > > > EQUALITY objectIdentifierMatch > > > > SINGLE-VALUE > > > > USAGE userApplications > > > > ) > > > > > > > > attributetype ( oid-at.X > > > > NAME 'selectorPropertyName' > > > > DESC 'Value(s) of this property of the application environment are > > > > evaluated for selection.' > > > > SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 > > > > EQUALITY caseIgnoreMatch > > > > SUBSTR caseIgnoreSubstringsMatch > > > > SINGLE-VALUE > > > > USAGE userApplications > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'policyConditionSelector' > > > > DESC 'Several subtypes of this are used to implement explicit > selection > > > > semantics by comparing the value of a candidate attribute/value pair > > > > or property/value pair to the value of selector criteria. Instances > of > > > > this SHALL include either selectorAttributeOID attribute/value pair > or > > > > selectorPropertyName attribute/value pair, but NEVER BOTH.' > > > > SUP policyConditionAuxClass > > > > AUXILIARY > > > > MAY ( selectorAttributeOID $ selectorPropertyName ) > > > > ) > > > > > > > > attributetype ( oid-at.X > > > > NAME 'selectorValue' > > > > DESC 'Candidate value of selectorAttributeOID or selectorPropertyName > > > > is evaluated for selection against the value of this, which > constitutes > > > > the selection criteria.' > > > > SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 > > > > EQUALITY caseIgnoreMatch > > > > SUBSTR caseIgnoreSubstringsMatch > > > > USAGE userApplications > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'explicitComparatorConditionSelector' > > > > DESC 'subtypes of this support various explicit semantics for > > > > evaluating > > > > a candidate value against selection criteria. Never create instances > > > > of this. ONLY create instances of subtypes of this.' > > > > SUP policyConditionSelector > > > > AUXILIARY > > > > MUST selectorValue > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'equalConditionSelector' > > > > DESC 'Represents selection according to the semantic of "equal". The > > > > candidate value is tested for "equal" with respect to the selection > > > > criteria.' > > > > SUP explicitComparatorConditionSelector > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'greaterThanConditionSelector' > > > > DESC 'Represents selection according to the semantic of > > > > "greaterThan". The candidate value is tested for "greaterThan" with > > > > respect to the selection criteria.' > > > > SUP explicitComparatorConditionSelector > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'lessThanConditionSelector' > > > > DESC 'Represents selection according to the semantic of "lessThan". > The > > > > candidate value is tested for "lessThan" with respect to the > selection > > > > criteria.' > > > > SUP explicitComparatorConditionSelector > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'greaterThanOrEqualConditionSelector' > > > > DESC 'Represents selection according to the semantic of > > > > "greaterThanOrEqual". The candidate value is tested for > > > > "greaterThanOrEqual" with respect to the selection criteria.' > > > > SUP explicitComparatorConditionSelector > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'lessThanOrEqualConditionSelector' > > > > DESC 'Represents selection according to the semantic of > > > > "lessThanOrEqual". The candidate value is tested for > "lessThanOrEqual" > > > > with respect to the selection criteria.' > > > > SUP explicitComparatorConditionSelector > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'beginsWithConditionSelector' > > > > DESC 'Represents selection according to the semantic of "beginsWith". > > > > The > > > > candidate value is tested for "beginsWith" with respect to the > > > > selection > > > > criteria.' > > > > SUP explicitComparatorConditionSelector > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'endsWithConditionSelector' > > > > DESC 'Represents selection according to the semantic of "endsWith". > The > > > > candidate value is tested for "endsWith" with respect to the > selection > > > > criteria.' > > > > SUP explicitComparatorConditionSelector > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'containsConditionSelector' > > > > DESC 'Represents selection according to the semantic of "contains". > The > > > > candidate value is tested for "contains" with respect to the > selection > > > > criteria.' > > > > SUP explicitComparatorConditionSelector > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'existsConditionSelector' > > > > DESC 'Represents selection according to the semantic of "exists". The > > > > candidate value is tested for "exists". The selection criteria is > > > > superfluous in this comparison.' > > > > SUP explicitComparatorConditionSelector > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'bitwiseANDConditionSelector' > > > > DESC 'Represents selection according to the semantic of "bitwiseAND". > > > > The > > > > candidate value is tested for "bitwiseAND" with respect to the > > > > selection > > > > criteria.' > > > > SUP explicitComparatorConditionSelector > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'bitwiseINclusiveORConditionSelector' > > > > DESC 'Represents selection according to the semantic of > > > > "bitwiseINclusiveOR". The candidate value is tested for > > > > "bitwiseINclusiveOR" with respect to the selection criteria.' > > > > SUP explicitComparatorConditionSelector > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'bitwiseEXclusiveORConditionSelector' > > > > DESC 'Represents selection according to the semantic of > > > > "bitwiseEXclusiveOR". The candidate value is tested for > > > > "bitwiseEXclusiveOR" with respect to the selection criteria.' > > > > SUP explicitComparatorConditionSelector > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'onesComplementConditionSelector' > > > > DESC 'Represents selection according to the semantic of > > > > "onesComplement". The candidate value is tested for "onesComplement". > > > > The > > > > selection criteria is superfluous in this comparison.' > > > > SUP explicitComparatorConditionSelector > > > > AUXILIARY > > > > ) > > > > > > > > attributetype ( oid-at.X > > > > NAME 'selectorEcma262regExp' > > > > DESC 'Candidate value of selectorAttributeOID or selectorPropertyName > > > > is evaluated for selection against the ecma262 regular expression > which > > > > is the value of this. See > http://www.ecma.ch/ecma1/stand/ecma-262.htm' > > > > SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 > > > > EQUALITY caseIgnoreMatch > > > > SUBSTR caseIgnoreSubstringsMatch > > > > USAGE userApplications > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'ecma262regExpConditionSelector' > > > > DESC 'ecma262regExpConditionSelector supports the semantic of > > > > evaluating > > > > a candidate value against an ecma262 regular expression.' > > > > SUP policyConditionSelector > > > > AUXILIARY > > > > MUST selectorEcma262regExp > > > > ) > > > > > > > > # policy action stuff > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'setterPolicyActionAssociation' > > > > DESC 'setterPolicyAction is AUXed by subtypes of policyActionSetter.' > > > > SUP policyRuleActionAssociation > > > > STRUCTURAL > > > > MUST cn > > > > ) > > > > > > > > attributetype ( oid-at.X > > > > NAME 'propertyNameToSet' > > > > DESC 'Value of this property of the application environment is set or > > > > modified by the action.' > > > > SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 > > > > EQUALITY caseIgnoreMatch > > > > SUBSTR caseIgnoreSubstringsMatch > > > > USAGE userApplications > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'policyActionSetter' > > > > DESC 'several subtypes of this implement explicit semantics for > setting > > > > or modifying the value of an application-defined, > application-dependent > > > > property.' > > > > SUP policyActionAuxClass > > > > AUXILIARY > > > > MUST propertyNameToSet > > > > ) > > > > > > > > attributetype ( oid-at.X > > > > NAME 'setToValue' > > > > DESC 'The value of a property of the application environment is set > to > > > > or modified by the value of this, which constitutes the value setting > > > > criteria.' > > > > SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 > > > > EQUALITY caseIgnoreMatch > > > > SUBSTR caseIgnoreSubstringsMatch > > > > USAGE userApplications > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'assignmentOperatorActionSetter' > > > > DESC 'subtypes of this support various semantics of setting a > candidate > > > > value according to value setting criteria. Never create instances of > > > > this. ONLY create instances of subtypes of this.' > > > > SUP policyActionSetter > > > > AUXILIARY > > > > MUST setToValue > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'setEqualToAssignmentOperatorActionSetter' > > > > DESC 'Represents value assignment according to the semantic of > > > > "setEqualTo". The value of the candidate property is assigned or > > > > modified > > > > by "setEqualTo" with respect to the value setting criteria.' > > > > SUP assignmentOperatorActionSetter > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'setPlusEqualToAssignmentOperatorActionSetter' > > > > DESC 'Represents value assignment according to the semantic of > > > > "setPlusEqualTo". The value of the candidate property is assigned or > > > > modified by "setPlusEqualTo" with respect to the value setting > > > > criteria.' > > > > SUP assignmentOperatorActionSetter > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'setMinusEqualToAssignmentOperatorActionSetter' > > > > DESC 'Represents value assignment according to the semantic of > > > > "setMinusEqualTo". The value of the candidate property is assigned > > > > or modified by "setMinusEqualTo" with respect to the value setting > > > > criteria.' > > > > SUP assignmentOperatorActionSetter > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'setMultEqualToAssignmentOperatorActionSetter' > > > > DESC 'Represents value assignment according to the semantic of > > > > "setMultEqualTo". The value of the candidate property is assigned or > > > > modified by "setMultEqualTo" with respect to the value setting > > > > criteria.' > > > > SUP assignmentOperatorActionSetter > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'setDivEqualToAssignmentOperatorActionSetter' > > > > DESC 'Represents value assignment according to the semantic of > > > > "setDivEqualTo". The value of the candidate property is assigned or > > > > modified by "setDivEqualTo" with respect to the value setting > > > > criteria.' > > > > SUP assignmentOperatorActionSetter > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'setModuloEqualToAssignmentOperatorActionSetter' > > > > DESC 'Represents value assignment according to the semantic of > > > > "setModuloEqualTo". The value of the candidate property is assigned > > > > or modified by "setModuloEqualTo" with respect to the value setting > > > > criteria.' > > > > SUP assignmentOperatorActionSetter > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'setShiftLeftByAssignmentOperatorActionSetter' > > > > DESC 'Represents value assignment according to the semantic of > > > > "setShiftLeftBy". The value of the candidate property is assigned or > > > > modified by "setShiftLeftBy" with respect to the value setting > > > > criteria.' > > > > SUP assignmentOperatorActionSetter > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'setShiftRightByAssignmentOperatorActionSetter' > > > > DESC 'Represents value assignment according to the semantic of > > > > "setShiftRightBy". The value of the candidate property is assigned > > > > or modified by "setShiftRightBy" with respect to the value setting > > > > criteria.' > > > > SUP assignmentOperatorActionSetter > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'setBitwiseANDwithAssignmentOperatorActionSetter' > > > > DESC 'Represents value assignment according to the semantic of > > > > "setBitwiseANDwith". The value of the candidate property is assigned > > > > or modified by "setBitwiseANDwith" with respect to the value setting > > > > criteria.' > > > > SUP assignmentOperatorActionSetter > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'setBitwiseINclusiveORwithAssignmentOperatorActionSetter' > > > > DESC 'Represents value assignment according to the semantic of > > > > "setBitwiseINclusiveORwith". The value of the candidate property is > > > > assigned or modified by "setBitwiseINclusiveORwith" with respect to > > > > the value setting criteria.' > > > > SUP assignmentOperatorActionSetter > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'setBitwiseEXclusiveORwithAssignmentOperatorActionSetter' > > > > DESC 'Represents value assignment according to the semantic of > > > > "setBitwiseEXclusiveORwith". The value of the candidate property is > > > > assigned or modified by "setBitwiseEXclusiveORwith" with respect to > > > > the value setting criteria.' > > > > SUP assignmentOperatorActionSetter > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'setOnesComplementAssignmentOperatorActionSetter' > > > > DESC 'Represents value assignment according to the semantic of > > > > "setOnesComplement". The value of the candidate property is assigned > > > > or modified by "setOnesComplement". The value setting criteria is > > > > superfluous in this operation.' > > > > SUP assignmentOperatorActionSetter > > > > AUXILIARY > > > > ) > > > > > > > > attributetype ( oid-at.X > > > > NAME 'setToEcma262regExp' > > > > DESC 'The value of a property of the application environment is > > > > set or modified according to an evaluation of this ecma262 regular > > > > expression. See http://www.ecma.ch/ecma1/stand/ecma-262.htm' > > > > SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 > > > > EQUALITY caseIgnoreMatch > > > > SUBSTR caseIgnoreSubstringsMatch > > > > USAGE userApplications > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'ecma262regExpActionSetter' > > > > DESC 'ecma262regExpActionSetter supports the semantic of setting > > > > a candidate value according to the evaluation an ecma262 regular > > > > expression.' > > > > SUP policyActionSetter > > > > AUXILIARY > > > > MUST setToEcma262regExp > > > > ) > > > > > > > > -- > > #::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::| > > # Larry Bartz | | > > # lbartz@parnelli.indy.cr.irs.gov | Ooo, ooo, | > > # | Ooo, ooo, oooooo! | > > # | I've got a gnu attitude! | > > # voice (317) 226-7060 | | > > # FAX (317) 226-6378 | | > > #::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::| -- #::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::| # Larry Bartz | | # lbartz@parnelli.indy.cr.irs.gov | Ooo, ooo, | # | Ooo, ooo, oooooo! | # | I've got a gnu attitude! | # voice (317) 226-7060 | | # FAX (317) 226-6378 | | #::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::| From majordomo@raleigh.ibm.com Thu Mar 29 09:55:09 2001 Received: from fwns2.raleigh.ibm.com (fwns2d.raleigh.ibm.com [204.146.167.236]) by ietf.org (8.9.1a/8.9.1a) with SMTP id JAA16505 for ; Thu, 29 Mar 2001 09:55:08 -0500 (EST) Received: from rtpmail03.raleigh.ibm.com (rtpmail03.raleigh.ibm.com [9.37.172.47]) by fwns2.raleigh.ibm.com (8.9.0/8.9.0/RTP-FW-1.2) with ESMTP id JAA22290; Thu, 29 Mar 2001 09:46:25 -0500 Received: from rtpaix11.raleigh.ibm.com (rtpaix11.raleigh.ibm.com [9.37.172.4]) by rtpmail03.raleigh.ibm.com (8.8.5/8.8.5/RTP-ral-1.1) with SMTP id JAA06676; Thu, 29 Mar 2001 09:46:24 -0500 Received: by rtpaix11.raleigh.ibm.com (AIX 4.1/UCB 5.64/4.03-RAL) id AA55586; Thu, 29 Mar 2001 09:05:30 -0500 Received: from rtpmail02.raleigh.ibm.com by rtpaix11.raleigh.ibm.com (AIX 4.1/UCB 5.64/4.03-RAL) id AA45338; Thu, 29 Mar 2001 09:05:27 -0500 Received: from fwns1.raleigh.ibm.com (fwns1.raleigh.ibm.com [9.37.0.3]) by rtpmail02.raleigh.ibm.com (8.8.5/8.8.5/RTP-ral-1.1) with ESMTP id JAA29038 for ; Thu, 29 Mar 2001 09:05:34 -0500 Received: from mx-relay1.treas.gov (mx-relay1.treas.gov [199.196.144.5]) by fwns1.raleigh.ibm.com (8.9.0/8.9.0/RTP-FW-1.2) with ESMTP id JAA26150 for ; Thu, 29 Mar 2001 09:05:28 -0500 Received: from tias4.treas.gov (tias-gw4.treas.gov [199.196.144.14]) by mx-relay1.treas.gov (8.9.1b+Sun/8.9.3) with SMTP id JAA17353 for ; Thu, 29 Mar 2001 09:05:29 -0500 (EST) Received: from mailhub.net.treas.gov by tias4.treas.gov via smtpd (for mx-relay.treas.gov [199.196.144.5]) with SMTP; 29 Mar 2001 14:05:29 UT Received: from mears.indy.cr.irs.gov (mailhub-3 [10.7.8.11]) by mailhub-3.net.treas.gov (8.9.3+Sun/8.9.3) with ESMTP id JAA24750 for ; Thu, 29 Mar 2001 09:02:28 -0500 (EST) Received: from parnelli.indy.cr.irs.gov (IDENT:lsbart35@localhost [127.0.0.1]) by mears.indy.cr.irs.gov (8.9.3/8.9.3) with ESMTP id JAA01802; Thu, 29 Mar 2001 09:05:26 -0500 Message-Id: <3AC34126.CAF7CBC3@parnelli.indy.cr.irs.gov> Date: Thu, 29 Mar 2001 09:05:26 -0500 From: "Larry S. Bartz" X-Mailer: Mozilla 4.72 [en] (X11; U; Linux 2.2.14-5.0smp i686) X-Accept-Language: en Mime-Version: 1.0 To: IETF Policy WG LIST Subject: functionally explicit conditions and actions Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: policy-owner@raleigh.ibm.com Precedence: bulk Reply-To: "Larry S. Bartz" Content-Transfer-Encoding: 7bit I've refactored the OCs and ATs I described a couple of weeks ago in http://atm.tut.fi/list-archive/policy/msg00402.html I've changed the naming scheme so it makes more sense from a Policy POV, from selector/setter to comparator/assignor. As I said before, these may be simply local implementation, an extension of draft-ietf-policy-core-schema-09.txt which conforms to rfc3060. OTOH, they might be interesting beyond the local scope. ##### policy condition stuff objectclass ( oid-oc.94 NAME 'ComparatorPolicyConditionAssociation' DESC 'ComparatorPolicyConditionAssociation is AUXed by subtypes of ComparatorPolicyConditionAux.' SUP policyRuleConditionAssociation STRUCTURAL MUST cn ) attributetype ( oid-at.92 NAME 'comparedAttributeOID' DESC 'Value(s) of this attribute of the candidate object are evaluated for selection.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 EQUALITY objectIdentifierMatch SINGLE-VALUE USAGE userApplications ) attributetype ( oid-at.93 NAME 'comparedPropertyName' DESC 'Value(s) of this property of the application environment are evaluated for selection.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SINGLE-VALUE USAGE userApplications ) objectclass ( oid-oc.95 NAME 'ComparatorPolicyConditionAux' DESC 'Several subtypes of this are used to implement explicit comparison semantics by comparing the value of a candidate attribute/value pair or property/value pair to the value of comparison criteria. Instances of this SHALL include either comparedAttributeOID attribute/value pair or comparedPropertyName attribute/value pair, but NEVER BOTH.' SUP policyConditionAuxClass AUXILIARY MAY ( comparedAttributeOID $ comparedPropertyName ) ) attributetype ( oid-at.94 NAME 'comparisonValue' DESC 'Candidate value of comparedAttributeOID or comparedPropertyName is evaluated for comparison against the value of this, which constitutes the comparison criteria.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch USAGE userApplications ) objectclass ( oid-oc.96 NAME 'ExplicitComparisonOperationPolicyConditionAux' DESC 'subtypes of this support various explicit semantics for evaluating a candidate value against comparison criteria. Never create instances of this. ONLY create instances of subtypes of this.' SUP ComparatorPolicyConditionAux AUXILIARY MUST comparisonValue ) objectclass ( oid-oc.97 NAME 'equalComparator' DESC 'Represents comparison according to the semantic of "equal". The candidate value is tested for "equal" with respect to the comparison criteria.' SUP ExplicitComparisonOperationPolicyConditionAux AUXILIARY ) objectclass ( oid-oc.98 NAME 'greaterThanComparator' DESC 'Represents comparison according to the semantic of "greaterThan". The candidate value is tested for "greaterThan" with respect to the comparison criteria.' SUP ExplicitComparisonOperationPolicyConditionAux AUXILIARY ) objectclass ( oid-oc.99 NAME 'lessThanComparator' DESC 'Represents comparison according to the semantic of "lessThan". The candidate value is tested for "lessThan" with respect to the comparison criteria.' SUP ExplicitComparisonOperationPolicyConditionAux AUXILIARY ) objectclass ( oid-oc.100 NAME 'greaterThanOrEqualComparator' DESC 'Represents comparison according to the semantic of "greaterThanOrEqual". The candidate value is tested for "greaterThanOrEqual" with respect to the comparison criteria.' SUP ExplicitComparisonOperationPolicyConditionAux AUXILIARY ) objectclass ( oid-oc.101 NAME 'lessThanOrEqualComparator' DESC 'Represents comparison according to the semantic of "lessThanOrEqual". The candidate value is tested for "lessThanOrEqual" with respect to the comparison criteria.' SUP ExplicitComparisonOperationPolicyConditionAux AUXILIARY ) objectclass ( oid-oc.102 NAME 'beginsWithComparator' DESC 'Represents comparison according to the semantic of "beginsWith". The candidate value is tested for "beginsWith" with respect to the comparison criteria.' SUP ExplicitComparisonOperationPolicyConditionAux AUXILIARY ) objectclass ( oid-oc.103 NAME 'endsWithComparator' DESC 'Represents comparison according to the semantic of "endsWith". The candidate value is tested for "endsWith" with respect to the comparison criteria.' SUP ExplicitComparisonOperationPolicyConditionAux AUXILIARY ) objectclass ( oid-oc.104 NAME 'containsComparator' DESC 'Represents comparison according to the semantic of "contains". The candidate value is tested for "contains" with respect to the comparison criteria.' SUP ExplicitComparisonOperationPolicyConditionAux AUXILIARY ) objectclass ( oid-oc.105 NAME 'existsComparator' DESC 'Represents comparison according to the semantic of "exists". The candidate value is tested for "exists". The comparison criteria is superfluous in this comparison.' SUP ExplicitComparisonOperationPolicyConditionAux AUXILIARY ) objectclass ( oid-oc.106 NAME 'bitwiseANDComparator' DESC 'Represents comparison according to the semantic of "bitwiseAND". The candidate value is tested for "bitwiseAND" with respect to the comparison criteria.' SUP ExplicitComparisonOperationPolicyConditionAux AUXILIARY ) objectclass ( oid-oc.107 NAME 'bitwiseINclusiveORComparator' DESC 'Represents comparison according to the semantic of "bitwiseINclusiveOR". The candidate value is tested for "bitwiseINclusiveOR" with respect to the comparison criteria.' SUP ExplicitComparisonOperationPolicyConditionAux AUXILIARY ) objectclass ( oid-oc.108 NAME 'bitwiseEXclusiveORComparator' DESC 'Represents comparison according to the semantic of "bitwiseEXclusiveOR". The candidate value is tested for "bitwiseEXclusiveOR" with respect to the comparison criteria.' SUP ExplicitComparisonOperationPolicyConditionAux AUXILIARY ) objectclass ( oid-oc.109 NAME 'onesComplementComparator' DESC 'Represents comparison according to the semantic of "onesComplement". The candidate value is tested for "onesComplement". The comparison criteria is superfluous in this comparison.' SUP ExplicitComparisonOperationPolicyConditionAux AUXILIARY ) attributetype ( oid-at.95 NAME 'comparisonEcma262RegExp' DESC 'Candidate value of comparedAttributeOID or comparedPropertyName is evaluated for comparison against the ecma262 regular expression which is the value of this. The ecma262 scripting language is also known as JavaScript, JScript, and by ISO 16262. See http://www.ecma.ch/ecma1/stand/ecma-262.htm' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch USAGE userApplications ) objectclass ( oid-oc.110 NAME 'ECMA262RegExpComparator' DESC 'ECMA262RegExpComparator supports the semantic of evaluating a candidate value against an ecma262 regular expression.' SUP ComparatorPolicyConditionAux AUXILIARY MUST comparisonEcma262RegExp ) # policy action stuff objectclass ( oid-oc.111 NAME 'AssignorPolicyActionAssociation' DESC 'AssignorPolicyActionAssociation is AUXed by subtypes of AssignorPolicyActionAux.' SUP policyRuleActionAssociation STRUCTURAL MUST cn ) attributetype ( oid-at.96 NAME 'assignedVariable' DESC 'Value of this property of the application environment is set or modified by the action.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch USAGE userApplications ) attributetype ( oid-at.97 NAME 'assignmentValue' DESC 'The value of a property of the application environment is set to or modified by the value of this, which constitutes the value setting criteria.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch USAGE userApplications ) objectclass ( oid-oc.112 NAME 'AssignorPolicyActionAux' DESC 'subtypes of this implement explicit semantics for setting or modifying the value of an application-defined, application-dependent property.' SUP policyActionAuxClass AUXILIARY MUST assignedVariable ) objectclass ( oid-oc.113 NAME 'ExplicitAssignmentOperationPolicyActionAux' DESC 'several subtypes of this implement explicit semantics for setting or modifying the value of an application-defined, application-dependent property.' SUP AssignorPolicyActionAux AUXILIARY MUST assignmentValue ) objectclass ( oid-oc.114 NAME 'EqualAssignor' DESC 'Represents value assignment according to the semantic of "Equal". The value of the candidate property is assigned or modified by "Equal" with respect to the value setting criteria.' SUP ExplicitAssignmentOperationPolicyActionAux AUXILIARY ) objectclass ( oid-oc.115 NAME 'PlusEqualAssignor' DESC 'Represents value assignment according to the semantic of "PlusEqual". The value of the candidate property is assigned or modified by "PlusEqual" with respect to the value setting criteria.' SUP ExplicitAssignmentOperationPolicyActionAux AUXILIARY ) objectclass ( oid-oc.116 NAME 'MinusEqualAssignor' DESC 'Represents value assignment according to the semantic of "MinusEqual". The value of the candidate property is assigned or modified by "MinusEqual" with respect to the value setting criteria.' SUP ExplicitAssignmentOperationPolicyActionAux AUXILIARY ) objectclass ( oid-oc.117 NAME 'MultEqualAssignor' DESC 'Represents value assignment according to the semantic of "MultEqual". The value of the candidate property is assigned or modified by "MultEqual" with respect to the value setting criteria.' SUP ExplicitAssignmentOperationPolicyActionAux AUXILIARY ) objectclass ( oid-oc.118 NAME 'DivEqualAssignor' DESC 'Represents value assignment according to the semantic of "DivEqual". The value of the candidate property is assigned or modified by "DivEqual" with respect to the value setting criteria.' SUP ExplicitAssignmentOperationPolicyActionAux AUXILIARY ) objectclass ( oid-oc.119 NAME 'ModuloEqualAssignor' DESC 'Represents value assignment according to the semantic of "ModuloEqual". The value of the candidate property is assigned or modified by "ModuloEqual" with respect to the value setting criteria.' SUP ExplicitAssignmentOperationPolicyActionAux AUXILIARY ) objectclass ( oid-oc.120 NAME 'ShiftLeftByAssignor' DESC 'Represents value assignment according to the semantic of "ShiftLeftBy". The value of the candidate property is assigned or modified by "ShiftLeftBy" with respect to the value setting criteria.' SUP ExplicitAssignmentOperationPolicyActionAux AUXILIARY ) objectclass ( oid-oc.121 NAME 'ShiftRightByAssignor' DESC 'Represents value assignment according to the semantic of "ShiftRightBy". The value of the candidate property is assigned or modified by "ShiftRightBy" with respect to the value setting criteria.' SUP ExplicitAssignmentOperationPolicyActionAux AUXILIARY ) objectclass ( oid-oc.122 NAME 'BitwiseANDwithAssignor' DESC 'Represents value assignment according to the semantic of "BitwiseANDwith". The value of the candidate property is assigned or modified by "BitwiseANDwith" with respect to the value setting criteria.' SUP ExplicitAssignmentOperationPolicyActionAux AUXILIARY ) objectclass ( oid-oc.123 NAME 'BitwiseINclusiveORwithAssignor' DESC 'Represents value assignment according to the semantic of "BitwiseINclusiveORwith". The value of the candidate property is assigned or modified by "BitwiseINclusiveORwith" with respect to the value setting criteria.' SUP ExplicitAssignmentOperationPolicyActionAux AUXILIARY ) objectclass ( oid-oc.124 NAME 'BitwiseEXclusiveORwithAssignor' DESC 'Represents value assignment according to the semantic of "BitwiseEXclusiveORwith". The value of the candidate property is assigned or modified by "BitwiseEXclusiveORwith" with respect to the value setting criteria.' SUP ExplicitAssignmentOperationPolicyActionAux AUXILIARY ) objectclass ( oid-oc.125 NAME 'OnesComplementAssignor' DESC 'Represents value assignment according to the semantic of "OnesComplement". The value of the candidate property is assigned or modified by "OnesComplement". The value setting criteria is superfluous in this operation.' SUP ExplicitAssignmentOperationPolicyActionAux AUXILIARY ) attributetype ( oid-at.98 NAME 'assignmentEcma262regExp' DESC 'The value of a property of the application environment is set or modified according to an evaluation of this ecma262 regular expression. The ecma262 scripting language is also known as JavaScript, JScript, and by ISO 16262. See http://www.ecma.ch/ecma1/stand/ecma-262.htm' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch USAGE userApplications ) objectclass ( oid-oc.126 NAME 'Ecma262regExpAssignor' DESC 'Ecma262regExpAssignor supports the semantic of setting a candidate value according to the evaluation an ecma262 regular expression.' SUP AssignorPolicyActionAux AUXILIARY MUST assignmentEcma262regExp ) -- #::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::| # Larry Bartz | | # lbartz@parnelli.indy.cr.irs.gov | Ooo, ooo, | # | Ooo, ooo, oooooo! | # | I've got a gnu attitude! | # voice (317) 226-7060 | | # FAX (317) 226-6378 | | #::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::| From majordomo@raleigh.ibm.com Thu Mar 29 15:32:03 2001 Received: from fwns1.raleigh.ibm.com (fwns1d.raleigh.ibm.com [204.146.167.235]) by ietf.org (8.9.1a/8.9.1a) with SMTP id PAA09209 for ; Thu, 29 Mar 2001 15:32:03 -0500 (EST) Received: from rtpmail02.raleigh.ibm.com (rtpmail02.raleigh.ibm.com [9.37.172.48]) by fwns1.raleigh.ibm.com (8.9.0/8.9.0/RTP-FW-1.2) with ESMTP id PAA06250; Thu, 29 Mar 2001 15:22:41 -0500 Received: from rtpaix11.raleigh.ibm.com (rtpaix11.raleigh.ibm.com [9.37.172.4]) by rtpmail02.raleigh.ibm.com (8.8.5/8.8.5/RTP-ral-1.1) with SMTP id PAA21148; Thu, 29 Mar 2001 15:22:40 -0500 Received: by rtpaix11.raleigh.ibm.com (AIX 4.1/UCB 5.64/4.03-RAL) id AA61722; Thu, 29 Mar 2001 14:57:01 -0500 Received: from rtpmail03.raleigh.ibm.com by rtpaix11.raleigh.ibm.com (AIX 4.1/UCB 5.64/4.03-RAL) id AA44306; Thu, 29 Mar 2001 14:56:58 -0500 Received: from fwns1.raleigh.ibm.com (fwns1.raleigh.ibm.com [9.37.0.3]) by rtpmail03.raleigh.ibm.com (8.8.5/8.8.5/RTP-ral-1.1) with ESMTP id OAA26780 for ; Thu, 29 Mar 2001 14:57:04 -0500 Received: from longmail2.lboard.com ([63.109.116.89]) by fwns1.raleigh.ibm.com (8.9.0/8.9.0/RTP-FW-1.2) with ESMTP id OAA17028 for ; Thu, 29 Mar 2001 14:57:03 -0500 Received: by longmail2.lboard.com with Internet Mail Service (5.5.2650.21) id ; Thu, 29 Mar 2001 14:56:53 -0500 Message-Id: From: Ed Ellesson To: "'policy@raleigh.ibm.com'" Subject: Proposed Interim Meeting (May 2001) of Policy WG Date: Thu, 29 Mar 2001 14:56:48 -0500 Mime-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Content-Type: text/plain; charset="iso-8859-1" Sender: policy-owner@raleigh.ibm.com Precedence: bulk Reply-To: Ed Ellesson Policy WG: The multiple author teams, who are working on our internet-draft deliverables, need a cross-team interim meeting to work out a coherent set of models prior to the London IETF, at which time we would like to be done. Rather than making the interim meeting a design team meeting, we thought we should give an opportunity to all interested parties to participate. The agenda for this interim meeting will be to agree on all open issues in order to complete the remaining deliverables: (We should have PCLS and Polterm through last call way before this) We had a couple of offers to host this interim working group meeting: May 7 (Monday) in Heidelberg was suggested, or May 13/14 (Sunday and Monday) in the US (Seattle, just before a network management conference occuring that week I that same city.) Could we get some feedback on the list about where people would like to see the meeting held, and who would be willing to come, depending on where it will be held? Thanks, Ed and Joel ****fyi********** Fyi, since I don't have the meeting minutes out yet, here is a summary of the new charter milestones we agreed on in Minneapolis: *Nov. '00: PCIM submittal for Proposed Std Status (done) *Mar. '01: PCLS last call *Mar. '01: Terminology draft last call (fyi track) *(May '01: Proposed Interim Meeting) *(April 6 '01: PCIM Extensions Next Draft) *Jul. 13, '01: PCIM Extensions Final *(Apr 6, '01: QPIM Next Draft) *Jul. 13, '01: QPIM Final *Aug. '01: QPLS *(Apr 27, '01: QDDIM Next Draft) *Jul. 14, '01: QDDIM Final *Aug. '01: last face-to-face wg meeting From majordomo@raleigh.ibm.com Fri Mar 30 08:04:48 2001 Received: from fwns2.raleigh.ibm.com (fwns2d.raleigh.ibm.com [204.146.167.236]) by ietf.org (8.9.1a/8.9.1a) with SMTP id IAA12867 for ; Fri, 30 Mar 2001 08:04:46 -0500 (EST) Received: from rtpmail02.raleigh.ibm.com (rtpmail02.raleigh.ibm.com [9.37.172.48]) by fwns2.raleigh.ibm.com (8.9.0/8.9.0/RTP-FW-1.2) with ESMTP id HAA34718; Fri, 30 Mar 2001 07:56:39 -0500 Received: from rtpaix11.raleigh.ibm.com (rtpaix11.raleigh.ibm.com [9.37.172.4]) by rtpmail02.raleigh.ibm.com (8.8.5/8.8.5/RTP-ral-1.1) with SMTP id HAA29266; Fri, 30 Mar 2001 07:56:38 -0500 Received: by rtpaix11.raleigh.ibm.com (AIX 4.1/UCB 5.64/4.03-RAL) id AA36468; Wed, 28 Mar 2001 08:27:58 -0500 Received: from rtpmail02.raleigh.ibm.com by rtpaix11.raleigh.ibm.com (AIX 4.1/UCB 5.64/4.03-RAL) id AA37150; Wed, 28 Mar 2001 08:27:47 -0500 Received: from fwns1.raleigh.ibm.com (fwns1.raleigh.ibm.com [9.37.0.3]) by rtpmail02.raleigh.ibm.com (8.8.5/8.8.5/RTP-ral-1.1) with ESMTP id IAA26350; Wed, 28 Mar 2001 08:27:50 -0500 Received: from mx-relay2.treas.gov (mx-relay2.treas.gov [199.196.144.6]) by fwns1.raleigh.ibm.com (8.9.0/8.9.0/RTP-FW-1.2) with ESMTP id IAA24014; Wed, 28 Mar 2001 08:27:44 -0500 Received: from tias4.treas.gov (tias-gw4.treas.gov [199.196.144.14]) by mx-relay2.treas.gov (8.9.1b+Sun/8.9.3) with SMTP id IAA00982; Wed, 28 Mar 2001 08:27:45 -0500 (EST) Received: from mailhub.net.treas.gov by tias4.treas.gov via smtpd (for mx-relay.treas.gov [199.196.144.6]) with SMTP; 28 Mar 2001 13:27:45 UT Received: from mears.indy.cr.irs.gov (mailhub-2 [10.7.8.10]) by mailhub-2.net.treas.gov (8.9.1b+Sun/8.9.3) with ESMTP id IAA13255; Wed, 28 Mar 2001 08:27:28 -0500 (EST) Received: from parnelli.indy.cr.irs.gov (IDENT:lsbart35@localhost [127.0.0.1]) by mears.indy.cr.irs.gov (8.9.3/8.9.3) with ESMTP id IAA15412; Wed, 28 Mar 2001 08:27:41 -0500 Message-Id: <3AC1E6CD.E4E69218@parnelli.indy.cr.irs.gov> Date: Wed, 28 Mar 2001 08:27:41 -0500 From: "Larry S. Bartz" X-Mailer: Mozilla 4.72 [en] (X11; U; Linux 2.2.14-5.0smp i686) X-Accept-Language: en Mime-Version: 1.0 To: Lee Rafalow , IETF Policy WG LIST Subject: Re: PCIMe MATCHing and more References: <3AAE4BD4.DE8AFACA@parnelli.indy.cr.irs.gov> <005201c0aca6$e0ef4660$11312509@raleigh.ibm.com> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: policy-owner@raleigh.ibm.com Precedence: bulk Reply-To: "Larry S. Bartz" Content-Transfer-Encoding: 7bit Lee Rafalow wrote: > > For applications of the policy framework to any text evaluating policies > (e.g., web), regular expressions will be very useful. > > See, for example, > http://www.ietf.org/internet-drafts/draft-beck-opes-irml-00.txt > I agree, Lee. That draft cites POSIX (ISO/IEC DIS 9945-2:1992 and IEEE Std 1003.2-1992) as the spec for regular expressions. In my message, I cited ECMA262 (aka ISO-16262, aka ECMAscript, aka JavaScript) as the spec for regular expressions. The ISO-16262 regular expression syntax is directly supported in web browser software and in readily available implementations of server-side ECMAscript. It can be parsed and interpreted practically anywhere. In addition, the ISO-16262 regular expression syntax is based upon Perl 5 regular expression syntax, which in turn has its roots in POSIX regExp, which in turn grew from C and Unix based regExp. The Perl environemt has subsequently added functionality to regExp, so that Perl-5/ECMA262/ISO-16262 regExp is a superset of POSIX regExp. While POSIX regExp is certainly a stable standard, I prefer the Perl-5/ECMA262/ISO-16262 superset, both for its enhanced capabilities and for its widespread implementation support. > Lee M. Rafalow > Voice: 1-919-254-4455; Fax: 1-919-254-6243 > IBM Internet Technology Management > IBM Corporation > P.O. Box 12195, BRQA/502 > RTP, NC 27709 USA > Alternate email: rafalow@us.ibm.com > Home email: rafalow@mindspring.com > ----- Original Message ----- > From: "Larry S. Bartz" > To: "Ron Cohen" > Cc: "IETF Policy WG LIST" > Sent: Tuesday, March 13, 2001 11:33 AM > Subject: Re: PCIMe MATCHing and more > > > Ron Cohen wrote: > > > > > > Larry, > > > > > > I understand that we could have adopted a regular expression approach. > > > > > > The explicit condition types which I described provide for all of the > > comparison operations. When we combine these with rfc3060's CNF, > > DNF, and negation facilities, we have a capability to compose complex > > condition specs from a well-defined, relatively small set of granular > > condition objects. I meant *this* to be the focus of my approach. If > > my message gave the impression that "regular expression" was the > > focus, my bad. > > > > The use of regular expression syntax is not a premiere feature of > > the strategy I've described. The use of regular expressions in > > conditions > > should be only in the rare, exceptional cases. It is there as an escape > > hatch for cases I couldn't imagine yet. The recommendation of ecma262 > > was simply to avoid requiring anyone to invent their own escape hatch. > > Further, it avoids requiring everyone to be able to recognize and > > negotiate everybody else's funky (or sublime) homemade escape hatches. > > > > > > > But, > > > I'm not sure that I understand what is wrong with the current approach. > What > > > is wrong with an IPv4address Value that specify both an address and an > > > address and mask using a semantic convention? > > > > > > If you can't determine the semantic of a variable unless and until > > you evaluate an instance value which is assigned to that variable, > > then you've got an ambiguous semantic. This might be fine under tightly > > controlled implementations; implementations under which all interpreters > > agree that they'll accept and comprehend "one of these" or "one of > > those" > > or "any one of these five kinds". > > > > But I don't think this is an appropriate strategy to promote and > > canonize > > as a strategy of a "core" information model. It's not reusable enough, > > not generalizable enough to be called "core". > > > > > > > Please give an example for > > > your statement "PCIMe specification of context sensitive inference of > > > MATCHing semantics for policy conditions implies a potential that the > > > correct inference might not be drawn", and show how your proposal > solves > > > this ambiguity. > > > > > > I intend not to resolve ambiguity, but to avoid ambiguity. > > > > The last paragraph of PCIMe 4.8.3 reveals the weakness I intended > > to address in my proposal. I'll paraphrase: > > > > "The "If" term and the "MATCH" operator are not directly modeled -- > > they are implied." > > > > and > > > > "Text accompanying the value class definition SHOULD be used as a > > guideline for interpreting the semantics of the MATCH relationship." > > > > By PCIMe's definition, an implementation cannot explicitly identify > > exactly what MATCH means. PCIMe resorts to unstructured and unparseable > > text as a guideline. > > > > There is a an arguably finite set of distinct and explicitly-defineable > > MATCH terms. I've laid 'em out. There aren't that many. It's easier to > > avoid ambiguity than it is to resolve it. > > > > > > > > > > The ability to define ranges of integers without including them within a > > > condition is to enable to reuse them with different variables. That is, > the > > > range 1000-1024 can specify a port range that can be used within a > condition > > > that checks this range against a source-port or a destination-port > variable. > > > How do you suggest to do that within your proposal? > > > > > > I wouldn't reuse the integer values. I would reuse the conditions. This > > follows the strategy of rfc3060. I would specify two reusable condition > > instances of greaterThanOrEqualConditionSelector and > > lessThanOrEqualConditionSelector. These two could be components of a > > reusable conditionList. Or each could be reusable, on its own, without > > regard for the other. > > > > > > > > > > Your propsal to define an explictcomparatorcondition resembles what we > had > > > several drafts ago, where we had an operator attribute within simple > > > condition that had enum values of equal, greater than, etc. We moved > from > > > this proposal to the current one to allow support mentioned in the > previous > > > point as well as other reasons. Possibly we did a mistake there, and we > > > should reconsider. But we need good reasons for that, which I don't see > at > > > the moment. > > > > > > I've got all nine PCIM drafts on hand. I don't see any discussion of an > > enum of operator attributes in the PCIM drafts. I missed it. Where is > > it? > > > > > > If Lee Rafalow is right, if PCIMe should withdraw from this procedural > > direction, I'll be just as happy. I think that what I've described *is* > > a "table-driven decision system" (to quote Lee) which conforms to the > > letter and the spirit of rfc3060. I agree with Lee's assertion that > > PCIMe is something else. If what I've described is nothing more than > > an rfc3060-conformant local implementation, fine by me. > > > > > > Explicitly yours, > > Larry > > > > > > > > > > Thanks > > > Ron > > > > > > > -----Original Message----- > > > > From: policy-owner@raleigh.ibm.com > > > > [mailto:policy-owner@raleigh.ibm.com]On Behalf Of Larry S. Bartz > > > > Sent: Saturday, March 10, 2001 12:20 AM > > > > To: IETF Policy WG LIST > > > > Subject: PCIMe MATCHing and more > > > > > > > > > > > > PCIMe's specification of context-sensitive inference of MATCHing > > > > semantics for policy conditions implies a potential that the correct > > > > inference might not be drawn. Unless the schema designer, the > > > > information infrastructure architect, and the policy-interpreting > > > > code designer/programmer are one-in-the-same, there's a lot of > > > > space between the rubber and the road. > > > > > > > > There may be a mechanism by which the MATCHing semantic can be made > > > > explicit. I'm suggesting such a mechanism, in which subtypes of > > > > policyConditionAuxClass are named for the particular comparison > > > > semantic they support. Use of these subtypes can constitute a > > > > semantic contract which binds the designer, implementor, and user > > > > to a model of usage which is unambiguous. > > > > > > > > As with policyCondition's MATCH semantic, policyAction's "set" > > > > semantic could be augmented. Unless one accepts the limitation of a > > > > simple assignment operation, "set" requires context-sensitive > > > > inference, just as condition's MATCH does. > > > > > > > > There may be a mechanism by which the "set" semantic of policyAction > > > > can be made explicit. I'm suggesting such a mechanism, in which > > > > subtypes of policyActionAuxClass are named for the particular > > > > assignment operation they support. Use of these subtypes can > constitute > > > > a semantic contract which binds the designer, implementor, and user > > > > to a model of usage which is unambiguous. > > > > > > > > In section 5.14, PCIMe invents syntaxes for complex expressions of > > > > several types of value criteria. These inventions will require > > > > implementors to likewise invent corresponding custom code. > > > > > > > > If the MATCHing semantics of conditions are made explicit, some of > > > > the syntactical constructs of PCIMe 5.14 are not necessary. For > > > > example, expresssions of value ranges can be accomplished by > > > > CNF'd granular policy conditions of the explicit types described > > > > here. > > > > > > > > There may yet be cases in which combinations of granular conditions > > > > cannot suffice, even when augmented by PCIM's CNF, DNF, and negation > > > > facilities. These cases might inspire the invention of syntax, > > > > semantics, and grammar as tools which can express and interpret > > > > complex information. > > > > > > > > Why invent such tools when they're already available? Rather than > > > > invent, the model described here capitalizes upon the regular > > > > expression syntax of the ECMA262 specification. ECMA262 regExp > > > > is richly expressive and platform-neutral. Everybody has an ECMA262 > > > > interpreter on their desktop, laptop, and (some) elsewhere. > > > > > > > > The objectclasses and attributetypes described below are named in > terms > > > > of "selector" (conditions) and "setter" (actions). These terms are not > > > > part of rfc3060's lexicon. I use these terms for these specific types > > > > simply to differentiate them from any others. > > > > > > > > I've described these in the ABNF, which is the usual form of > expression > > > > for Directory schema. I realize that the PCIMe draft is not a schema > > > > proposal, and that the ABNF is not the usual form of expression for > > > > Policy WG drafts which are not explicitly about implementation of > > > > Policy in the Directory. Forgive me. I'm a little Directory-centric. > > > > I hope Policy WG's members have seen and digested enough ABNF by now, > > > > so that what I'm describing is more or less obvious. > > > > > > > > Your comments are most welcome. If you think this has merit but needs > > > > work, please say so. If you think it's tripe, say that, too. > > > > > > > > Long lines are folded, to enhance readability. > > > > > > > > ##### policy condition stuff > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'selectorPolicyConditionAssociation' > > > > DESC 'selectorPolicyCondition is AUXed by subtypes of > > > > policyConditionSelector.' > > > > SUP policyRuleConditionAssociation > > > > STRUCTURAL > > > > MUST cn > > > > ) > > > > > > > > attributetype ( oid-at.X > > > > NAME 'selectorAttributeOID' > > > > DESC 'Value(s) of this attribute of the candidate object are > evaluated > > > > for selection.' > > > > SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 > > > > EQUALITY objectIdentifierMatch > > > > SINGLE-VALUE > > > > USAGE userApplications > > > > ) > > > > > > > > attributetype ( oid-at.X > > > > NAME 'selectorPropertyName' > > > > DESC 'Value(s) of this property of the application environment are > > > > evaluated for selection.' > > > > SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 > > > > EQUALITY caseIgnoreMatch > > > > SUBSTR caseIgnoreSubstringsMatch > > > > SINGLE-VALUE > > > > USAGE userApplications > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'policyConditionSelector' > > > > DESC 'Several subtypes of this are used to implement explicit > selection > > > > semantics by comparing the value of a candidate attribute/value pair > > > > or property/value pair to the value of selector criteria. Instances > of > > > > this SHALL include either selectorAttributeOID attribute/value pair > or > > > > selectorPropertyName attribute/value pair, but NEVER BOTH.' > > > > SUP policyConditionAuxClass > > > > AUXILIARY > > > > MAY ( selectorAttributeOID $ selectorPropertyName ) > > > > ) > > > > > > > > attributetype ( oid-at.X > > > > NAME 'selectorValue' > > > > DESC 'Candidate value of selectorAttributeOID or selectorPropertyName > > > > is evaluated for selection against the value of this, which > constitutes > > > > the selection criteria.' > > > > SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 > > > > EQUALITY caseIgnoreMatch > > > > SUBSTR caseIgnoreSubstringsMatch > > > > USAGE userApplications > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'explicitComparatorConditionSelector' > > > > DESC 'subtypes of this support various explicit semantics for > > > > evaluating > > > > a candidate value against selection criteria. Never create instances > > > > of this. ONLY create instances of subtypes of this.' > > > > SUP policyConditionSelector > > > > AUXILIARY > > > > MUST selectorValue > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'equalConditionSelector' > > > > DESC 'Represents selection according to the semantic of "equal". The > > > > candidate value is tested for "equal" with respect to the selection > > > > criteria.' > > > > SUP explicitComparatorConditionSelector > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'greaterThanConditionSelector' > > > > DESC 'Represents selection according to the semantic of > > > > "greaterThan". The candidate value is tested for "greaterThan" with > > > > respect to the selection criteria.' > > > > SUP explicitComparatorConditionSelector > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'lessThanConditionSelector' > > > > DESC 'Represents selection according to the semantic of "lessThan". > The > > > > candidate value is tested for "lessThan" with respect to the > selection > > > > criteria.' > > > > SUP explicitComparatorConditionSelector > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'greaterThanOrEqualConditionSelector' > > > > DESC 'Represents selection according to the semantic of > > > > "greaterThanOrEqual". The candidate value is tested for > > > > "greaterThanOrEqual" with respect to the selection criteria.' > > > > SUP explicitComparatorConditionSelector > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'lessThanOrEqualConditionSelector' > > > > DESC 'Represents selection according to the semantic of > > > > "lessThanOrEqual". The candidate value is tested for > "lessThanOrEqual" > > > > with respect to the selection criteria.' > > > > SUP explicitComparatorConditionSelector > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'beginsWithConditionSelector' > > > > DESC 'Represents selection according to the semantic of "beginsWith". > > > > The > > > > candidate value is tested for "beginsWith" with respect to the > > > > selection > > > > criteria.' > > > > SUP explicitComparatorConditionSelector > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'endsWithConditionSelector' > > > > DESC 'Represents selection according to the semantic of "endsWith". > The > > > > candidate value is tested for "endsWith" with respect to the > selection > > > > criteria.' > > > > SUP explicitComparatorConditionSelector > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'containsConditionSelector' > > > > DESC 'Represents selection according to the semantic of "contains". > The > > > > candidate value is tested for "contains" with respect to the > selection > > > > criteria.' > > > > SUP explicitComparatorConditionSelector > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'existsConditionSelector' > > > > DESC 'Represents selection according to the semantic of "exists". The > > > > candidate value is tested for "exists". The selection criteria is > > > > superfluous in this comparison.' > > > > SUP explicitComparatorConditionSelector > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'bitwiseANDConditionSelector' > > > > DESC 'Represents selection according to the semantic of "bitwiseAND". > > > > The > > > > candidate value is tested for "bitwiseAND" with respect to the > > > > selection > > > > criteria.' > > > > SUP explicitComparatorConditionSelector > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'bitwiseINclusiveORConditionSelector' > > > > DESC 'Represents selection according to the semantic of > > > > "bitwiseINclusiveOR". The candidate value is tested for > > > > "bitwiseINclusiveOR" with respect to the selection criteria.' > > > > SUP explicitComparatorConditionSelector > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'bitwiseEXclusiveORConditionSelector' > > > > DESC 'Represents selection according to the semantic of > > > > "bitwiseEXclusiveOR". The candidate value is tested for > > > > "bitwiseEXclusiveOR" with respect to the selection criteria.' > > > > SUP explicitComparatorConditionSelector > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'onesComplementConditionSelector' > > > > DESC 'Represents selection according to the semantic of > > > > "onesComplement". The candidate value is tested for "onesComplement". > > > > The > > > > selection criteria is superfluous in this comparison.' > > > > SUP explicitComparatorConditionSelector > > > > AUXILIARY > > > > ) > > > > > > > > attributetype ( oid-at.X > > > > NAME 'selectorEcma262regExp' > > > > DESC 'Candidate value of selectorAttributeOID or selectorPropertyName > > > > is evaluated for selection against the ecma262 regular expression > which > > > > is the value of this. See > http://www.ecma.ch/ecma1/stand/ecma-262.htm' > > > > SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 > > > > EQUALITY caseIgnoreMatch > > > > SUBSTR caseIgnoreSubstringsMatch > > > > USAGE userApplications > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'ecma262regExpConditionSelector' > > > > DESC 'ecma262regExpConditionSelector supports the semantic of > > > > evaluating > > > > a candidate value against an ecma262 regular expression.' > > > > SUP policyConditionSelector > > > > AUXILIARY > > > > MUST selectorEcma262regExp > > > > ) > > > > > > > > # policy action stuff > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'setterPolicyActionAssociation' > > > > DESC 'setterPolicyAction is AUXed by subtypes of policyActionSetter.' > > > > SUP policyRuleActionAssociation > > > > STRUCTURAL > > > > MUST cn > > > > ) > > > > > > > > attributetype ( oid-at.X > > > > NAME 'propertyNameToSet' > > > > DESC 'Value of this property of the application environment is set or > > > > modified by the action.' > > > > SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 > > > > EQUALITY caseIgnoreMatch > > > > SUBSTR caseIgnoreSubstringsMatch > > > > USAGE userApplications > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'policyActionSetter' > > > > DESC 'several subtypes of this implement explicit semantics for > setting > > > > or modifying the value of an application-defined, > application-dependent > > > > property.' > > > > SUP policyActionAuxClass > > > > AUXILIARY > > > > MUST propertyNameToSet > > > > ) > > > > > > > > attributetype ( oid-at.X > > > > NAME 'setToValue' > > > > DESC 'The value of a property of the application environment is set > to > > > > or modified by the value of this, which constitutes the value setting > > > > criteria.' > > > > SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 > > > > EQUALITY caseIgnoreMatch > > > > SUBSTR caseIgnoreSubstringsMatch > > > > USAGE userApplications > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'assignmentOperatorActionSetter' > > > > DESC 'subtypes of this support various semantics of setting a > candidate > > > > value according to value setting criteria. Never create instances of > > > > this. ONLY create instances of subtypes of this.' > > > > SUP policyActionSetter > > > > AUXILIARY > > > > MUST setToValue > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'setEqualToAssignmentOperatorActionSetter' > > > > DESC 'Represents value assignment according to the semantic of > > > > "setEqualTo". The value of the candidate property is assigned or > > > > modified > > > > by "setEqualTo" with respect to the value setting criteria.' > > > > SUP assignmentOperatorActionSetter > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'setPlusEqualToAssignmentOperatorActionSetter' > > > > DESC 'Represents value assignment according to the semantic of > > > > "setPlusEqualTo". The value of the candidate property is assigned or > > > > modified by "setPlusEqualTo" with respect to the value setting > > > > criteria.' > > > > SUP assignmentOperatorActionSetter > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'setMinusEqualToAssignmentOperatorActionSetter' > > > > DESC 'Represents value assignment according to the semantic of > > > > "setMinusEqualTo". The value of the candidate property is assigned > > > > or modified by "setMinusEqualTo" with respect to the value setting > > > > criteria.' > > > > SUP assignmentOperatorActionSetter > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'setMultEqualToAssignmentOperatorActionSetter' > > > > DESC 'Represents value assignment according to the semantic of > > > > "setMultEqualTo". The value of the candidate property is assigned or > > > > modified by "setMultEqualTo" with respect to the value setting > > > > criteria.' > > > > SUP assignmentOperatorActionSetter > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'setDivEqualToAssignmentOperatorActionSetter' > > > > DESC 'Represents value assignment according to the semantic of > > > > "setDivEqualTo". The value of the candidate property is assigned or > > > > modified by "setDivEqualTo" with respect to the value setting > > > > criteria.' > > > > SUP assignmentOperatorActionSetter > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'setModuloEqualToAssignmentOperatorActionSetter' > > > > DESC 'Represents value assignment according to the semantic of > > > > "setModuloEqualTo". The value of the candidate property is assigned > > > > or modified by "setModuloEqualTo" with respect to the value setting > > > > criteria.' > > > > SUP assignmentOperatorActionSetter > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'setShiftLeftByAssignmentOperatorActionSetter' > > > > DESC 'Represents value assignment according to the semantic of > > > > "setShiftLeftBy". The value of the candidate property is assigned or > > > > modified by "setShiftLeftBy" with respect to the value setting > > > > criteria.' > > > > SUP assignmentOperatorActionSetter > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'setShiftRightByAssignmentOperatorActionSetter' > > > > DESC 'Represents value assignment according to the semantic of > > > > "setShiftRightBy". The value of the candidate property is assigned > > > > or modified by "setShiftRightBy" with respect to the value setting > > > > criteria.' > > > > SUP assignmentOperatorActionSetter > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'setBitwiseANDwithAssignmentOperatorActionSetter' > > > > DESC 'Represents value assignment according to the semantic of > > > > "setBitwiseANDwith". The value of the candidate property is assigned > > > > or modified by "setBitwiseANDwith" with respect to the value setting > > > > criteria.' > > > > SUP assignmentOperatorActionSetter > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'setBitwiseINclusiveORwithAssignmentOperatorActionSetter' > > > > DESC 'Represents value assignment according to the semantic of > > > > "setBitwiseINclusiveORwith". The value of the candidate property is > > > > assigned or modified by "setBitwiseINclusiveORwith" with respect to > > > > the value setting criteria.' > > > > SUP assignmentOperatorActionSetter > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'setBitwiseEXclusiveORwithAssignmentOperatorActionSetter' > > > > DESC 'Represents value assignment according to the semantic of > > > > "setBitwiseEXclusiveORwith". The value of the candidate property is > > > > assigned or modified by "setBitwiseEXclusiveORwith" with respect to > > > > the value setting criteria.' > > > > SUP assignmentOperatorActionSetter > > > > AUXILIARY > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'setOnesComplementAssignmentOperatorActionSetter' > > > > DESC 'Represents value assignment according to the semantic of > > > > "setOnesComplement". The value of the candidate property is assigned > > > > or modified by "setOnesComplement". The value setting criteria is > > > > superfluous in this operation.' > > > > SUP assignmentOperatorActionSetter > > > > AUXILIARY > > > > ) > > > > > > > > attributetype ( oid-at.X > > > > NAME 'setToEcma262regExp' > > > > DESC 'The value of a property of the application environment is > > > > set or modified according to an evaluation of this ecma262 regular > > > > expression. See http://www.ecma.ch/ecma1/stand/ecma-262.htm' > > > > SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 > > > > EQUALITY caseIgnoreMatch > > > > SUBSTR caseIgnoreSubstringsMatch > > > > USAGE userApplications > > > > ) > > > > > > > > objectclass ( oid-oc.X > > > > NAME 'ecma262regExpActionSetter' > > > > DESC 'ecma262regExpActionSetter supports the semantic of setting > > > > a candidate value according to the evaluation an ecma262 regular > > > > expression.' > > > > SUP policyActionSetter > > > > AUXILIARY > > > > MUST setToEcma262regExp > > > > ) > > > > > > > > -- > > #::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::| > > # Larry Bartz | | > > # lbartz@parnelli.indy.cr.irs.gov | Ooo, ooo, | > > # | Ooo, ooo, oooooo! | > > # | I've got a gnu attitude! | > > # voice (317) 226-7060 | | > > # FAX (317) 226-6378 | | > > #::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::| -- #::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::| # Larry Bartz | | # lbartz@parnelli.indy.cr.irs.gov | Ooo, ooo, | # | Ooo, ooo, oooooo! | # | I've got a gnu attitude! | # voice (317) 226-7060 | | # FAX (317) 226-6378 | | #::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::|