Subject: RE: [midcom] Semantics Of "Session"

From: "Christian Huitema" <[email-masked]>
Date: Fri, 2 Aug 2002 09:03:01 -0700

> From: Scott Brim [mailto:[email-masked]] 
> On Fri, Aug 02, 2002 11:32:35AM -0400, Tom-PT Taylor allegedly wrote:
> > Is there any semantic content to a MIDCOM session, then, 
> except as a policy
> > context for the Middlebox to use when evaluating requests 
> from the Agent?  
> 
> During your presentation, and occasionally in others, I would 
> ask myself
> "what's a session?".  There are no semantics that need a session
> concept.  However there needs to be shared state on both 
> ends, including
> a cookie which can be assigned to rules and used arbitrarily.  We can
> conceive of uses for it today (like 'I'm done with everything with
> cookie xyzzy'), and there may be more in the future. 

I don't think we need any concept of a midcom session, and specifically
any concept tying the state of the "session" to the validity of rules
installed in the meddlebox. A session might be useful as a form of
transport & security shortcut, i.e. authenticate the requestor once per
session instead of once per transaction, but that is about the only
thing that is really needed. Specifically, an agent must be able to
install a rule that is supposed to be valid for some lifetime, go off
the network, and be confident that the rule is operative.

-- Christian Huitema

_______________________________________________
midcom mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/midcom

---

From: "Cedric Aoun" <[email-masked]>
Date: Fri, 2 Aug 2002 19:20:15 +0200

I still remember our bar BOF and small meeting that we had in London last
year in August, we're we all rejected the notion of a "session" as it meant
zillions of things. we all agreed that the notion of session was more a
notion of an association relation based on trust and no more (i.e. it is an
SA or something similar).
The establishment of the association starts with the authorization policy
provisioning matching the authorized agents. This should be augmented by
having an SA between the Middlebox and the Midcom agent.
I agree with Christian, the protocol semantics should not include any form
of session information.
Cedric 

-----Original Message-----
From: Christian Huitema [mailto:[email-masked]]
Sent: 02 August 2002 18:03
To: Scott Brim; [email-masked]
Subject: RE: [midcom] Semantics Of "Session"

-- Christian Huitema

---

From: "Cedric Aoun" <[email-masked]>
Date: Fri, 2 Aug 2002 19:57:19 +0200

I think that the requirement is to be able to have a handoff of 
policy rules. It is sufficient to have the association of policy rules
with the MIDCOM agent that installed them.
When the handoff happens another authorized Midcom agent could have
ownership
of the policy rules, we are discussing what should be the common identifier
of
all these policy rules (installed by the failed-over agent), the MIDCOM
agent ID
of the failed-over agent should be sufficient. Don't you agree?
Cedric

-----Original Message-----
From: Scott Brim [mailto:[email-masked]]
Sent: 02 August 2002 19:40
To: [email-masked]
Subject: Re: [midcom] Semantics Of "Session"

On Fri, Aug 02, 2002 01:31:48PM -0400, Tom-PT Taylor allegedly wrote:
> 
> Just on your very last point, you go beyond Christian.  The framework
shows
> very clearly a formal start of session and end of session exchange.  I see
> no choice but to indicate such exchanges at the semantic level, however
they
> are realized in practice.  But we can omit the session identifier from all
> other information exchanges.

The Framework was not completely finished imho.  There were several
ideas in it which hadn't been completely cleaned up.  Personally I
didn't push for doing so because I thought the requirements were more
important, the framework was non-normative, and we wanted to get to the
actual protocol.  So I would not take the Framework as gospel.

Personally I like the "session" identifier, but I wouldn't call it that.

...Scott

> From: Aoun, Cedric [GOLF:MA01:EXCH] 
> Sent: Friday, August 02, 2002 1:20 PM
> To: 'Christian Huitema'; Scott Brim; [email-masked]

---

From: "Tom-PT Taylor" <[email-masked]>
Date: Fri, 2 Aug 2002 14:09:55 -0400

When we discussed handoff, or rather, takeover, we agreed we certainly
needed the capability.  I know Jonathan argued that takeover should be on a
per-rule basis, so rules should have globally unique identifiers to make
this easy.  I had the feeling others accepted this.

-----Original Message-----
From: Aoun, Cedric [GOLF:MA01:EXCH] 
Sent: Friday, August 02, 2002 1:57 PM
To: 'Scott Brim'; [email-masked]
Subject: RE: [midcom] Semantics Of "Session"

Cedric 

-----Original Message----- 
From: Scott Brim [mailto:[email-masked]] 
Sent: 02 August 2002 19:40 
To: [email-masked] 
Subject: Re: [midcom] Semantics Of "Session" 

shows 

they