Subject: Re: new version of the Policy Framework Core Schema I-D...

From: "John Strassner" <[email-masked]>
Date: Wed, 10 Feb 1999 12:43:27 -0800

Gee, that's a shame, because there are specific items in this I-D that
address your concerns that you voiced in Orlando. And the reason it
was sent to the list is because the interim meeting is MONDAY, and it
can take the editor several days to process a submission.

John
-----Original Message-----
From: Michael Richardson <[email-masked]>
To: John Strassner <[email-masked]>
Cc: [email-masked] <[email-masked]>
Date: Wednesday, February 10, 1999 8:58 AM
Subject: Re: new version of the Policy Framework Core Schema I-D...

>
>unsubscribe policy
>
>--
>
>  I don't have bandwidth (personal or network) to have drafts posted
to the
>mailing list.
>
>   :!mcr!:            |  Solidum Systems Corporation,
http://www.solidum.com
>   Michael Richardson |For a better connected world,where data flows
faster<tm>
> Personal: <A
HREF="http://www.sandelman.ottawa.on.ca/People/Michael_Richardson/Bio.
html">[email-masked]</A>. PGP key available.
> Corporate: <A HREF="mailto:[email-masked]">[email-masked]</A>.
>
>
>

---

From: Kevin Fall <[email-masked]>
Date: Wed, 10 Feb 1999 16:37:47 -0800

I just went through this and have a few high-level questions.  Some of them
were sticky issues in Orlando.

1> The restriction to pure CNF or DNF seem to me to be more restrictive
than necessary.  Presumably mixed CNF/DNF styles should be able to be
parsed, plus allowing them would provide for removal of the
policyRuleConditionListType
attribute.

2> In the case of >1 TRUE conditions, all associated actions are to be
executed
and the order of them can indicated by the 'n:DN' indications.  Based on
some
experience with our own system (and language), I wonder whether it wouldn't
be more straightforward to assign single actions to policy rules.  The
single actions may themselves contain ordered lists of additional actions to
be executed [in order].
Note that we have also found useful the notion that an action can disable
the
execution of subsequent actions [e.g. imagine actions have a "return value"
so
that they can indicate whether subsequent actions should be executed or not.
At
the low level (i.e. packets), this corresponds to, say, a filter dropping a
packet and
indicating that processing should not proceed].

3> The notion of rule priorities seems subject to confusion and not clearly
needed.  With a sufficiently rich set of operators to define conditions, why
should priorities be used?

4> While I realize LDAP seems to be heavily favored in the WG charter, would
it make sense to separate the info model from its LDAP representation and
produce a separate document indicating the appropriate mapping to LDAP?  I
for
one find it a bit cumbersome to fish out the design details from
the LDAP details.

- K