Subject: [Dime] IPFilterRule grammar

From: Anders Kristensen <[email-masked]>
Date: Wed, 15 Nov 2006 17:35:35 -0500

RFC 3588 defines the IPFilterRule AVP type as being an OctetString that 
conforms to the grammar:

          action dir proto from src to dst [options]

          action       permit - Allow packets that match the rule.
                       deny   - Drop packets that match the rule.

          dir          "in" is from the terminal, "out" is to the
                       terminal.

          proto        An IP protocol specified by number.  The "ip"
                       keyword means any protocol will match.

          src and dst  <address/mask> [ports]
          ...

It's not clear to me from this description whether "from" and "to" are 
literals supposed to appear in the actual IPFilterRule or not. I've seen 
both interpretations used. Which is right?

If 3588 is being rev'ed I think it would be a good idea to rewrite this 
grammar to follow RFC 4234.

Thanks,
Anders

_______________________________________________
DiME mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dime

---

From: Victor Fajardo <[email-masked]>
Date: Wed, 15 Nov 2006 17:58:34 -0500

Hi Anders,
> RFC 3588 defines the IPFilterRule AVP type as being an OctetString 
> that conforms to the grammar:
>
> literals supposed to appear in the actual IPFilterRule or not. I've 
> seen both interpretations used. Which is right?
>
> If 3588 is being rev'ed I think it would be a good idea to rewrite 
> this grammar to follow RFC 4234.

My reading on this is that they are literals that can appear in the text 
rule. Some derivative examples can be found in 
draft-ietf-radext-filter-rules-01.txt. Given that, I'm not sure there is 
really a problem that needs to be fixed.

best regards,
victor

---

From: Anders Kristensen <[email-masked]>
Date: Wed, 15 Nov 2006 20:51:08 -0500

> really a problem that needs to be fixed.

The grammar is supposed to clearly and unambiguously define valid 
strings. If you have to resort to looking at examples to figure out what 
  the intention is then that's probably a good indication that the 
grammar is not well defined. IMHO, that's what we have here.

Thanks,
Anders

---

From: Victor Fajardo <[email-masked]>
Date: Wed, 15 Nov 2006 22:13:49 -0500

Hi Anders,
>>
>> My reading on this is that they are literals that can appear in the 
>> text rule. Some derivative examples can be found in 
>> draft-ietf-radext-filter-rules-01.txt. Given that, I'm not sure there 
>> is really a problem that needs to be fixed.
>
> strings. If you have to resort to looking at examples to figure out 
> what  the intention is then that's probably a good indication that the 

I guess I would argue the opposite. My thinking was that the semantics 
and usage was well defined and well understood and hence there were 
derivative usages in new/existing drafts. In anycase, we can get more 
feedback and see if this is really an issue where syntax changes are 
required or just the addition of clarifying text would be sufficient. 
Note that changing the syntax have implications on existing 
implementations as well as ongoing protocol work.

best regards,
victor