Subject: RE: IPSec Policy Model

From: "Jason, Jamie" <[email-masked]>
Date: Wed, 9 May 2001 16:40:16 -0700

I think that for the next version of the draft, we probably should put some
verbage in it to explain how conditions and filters are combined.  But, for
the time being...

Multiple conditions are grouped by the GroupNumber attribute in the
association SAConditionInRule - this attribute is inherited from
PolicyConditionInPolicyRule, which is defined in the Policy Core Information
Model (PCIM).  PolicyRule, which is also defined in PCIM, has an attribute
ConditionListType.  See pages 28 & 29 of RFC 3060 for an explanation of
this.  A short description is:
- if the list type is Conjunctive Normal Form (CNF), then the individual
conditions in a group are ORed and condition groups are ANDed
- if the list type is Disjunctive Normal Form (DNF), then the individual
conditions in a group are ANDed and the condition groups are ORed
Note...that the individual conditions may be negated.

As for FilterList, it can be found on page 110 in Appendix C of the draft
and the appropriate assocation EntriesInFilterList can be found on page 112
in the same appendix.  The association EntriesInFilterList has an attribute,
EntrySequence, which is defined as follows:

"The order of the Entry relative to all others in the FilterList. A value of
zero indicates that all the Entries should be ANDed together. Use of the
Sequence property should be consistent across the List. It is not valid to
define some Entries as ANDed in the FilterList (Sequence=0) while other
Entries have a non-zero Sequence number."

So, specific filter entries can either be ANDed or ORed.

Hope that this helps.

Jamie

> -----Original Message-----
> From: Casey Carr [mailto:[email-masked]]
> Sent: Wednesday, May 09, 2001 2:49 PM
> To: IPSec Policy WG
> Subject: IPSec Policy Model
> 
> 
> Looking for a pointer to the correct paragraph in the correct 
> document for
> the following:
> 
> I have been unable to locate the definition for the use of 
> FilterInCondition
> and ConditionInRule.  I believe that the original
> draft-ietf-ipsp-config-policy-model-00.txt (I no longer have a copy)
> described exactly how the filters were suppose to be used and how the
> conditions were supposed to be used.  The FilterList definition in the
> draft-ietf-ipsp-config-policy-model-01.txt document defines 
> "FilterList
> aggregates an ANDed set of filters" but I could not find a 
> statement like
> this in the 02 draft.  Presumably because the FilterList 
> object was removed.
> 
> How are multiple conditions supposed to be evaluated so that a single
> true/false results when a SARule has multiple conditions and 
> each condition
> has multiple filters?  I believe the original 00 draft 
> covered this but I am
> unable to find this in the new draft or any of the DMTF documents.
> 
> My assumption is that all filters are ANDed together (of 
> course taking into
> account the "negated" attribute).  If all filters evaluate to 
> true then the
> condition is true. If this is the case, then "EntrySequence" 
> attribute of
> the aggregation is meaningless.  This same process would then 
> be repeated
> for each condition in the rule and the results of each 
> condition are ANDed
> together.
> 
> Would someone please point me to the correct document to 
> validate/correct my
> assumption?
> 
> Casey
> 
>

---

From: "Casey Carr" <[email-masked]>
Date: Thu, 10 May 2001 09:03:19 -0400

Thank you Jamie.  That is exactly what I was looking for.  Just didn't dig
deep enough to get to RFC 3060.

Casey

> From: Jason, Jamie [mailto:[email-masked]]
> Sent: Wednesday, May 09, 2001 7:40 PM
> To: [email-masked]'; IPSec Policy WG
> Subject: RE: IPSec Policy Model
>
>