Re: [xacml] Groups - DLP-NAC profile uploaded

Hi,

    

    Why does the ipAddress-value data type have a network mask?

    

    Maybe it was discussed on a call when I was not present, and I am
    not a networking expert and might not understand what the intention
    was, but I tried to retrace the discussion on the list. If
    ipAddress-value is intended to represent a specific network
    endpoint, then it should not contain a mask, since masks are used to
    represent IP address ranges, right?

    

    Likewise, the matching functions which use a pattern, they should
    not be comparing the mask for straight equality, right? I read the
    intent of the matching functions to be used for checking whether an
    ipAddress-value is within the network segment denoted by the
    ipAddress-pattern. The value should be within the range of the
    pattern, so there should not be a check to see that the mask is
    equal, or actually, the value should not have a mask in the first
    place.

    

    Also, regarding the network match function, now it is defined as a
    strict equality function, but it could be useful to separate between
    an "equals" and a "match", where the latter allows for one argument
    to be a subset of the other.

    

    And, did you consider the need of an ipAddress value equal function
    which also checks the port? BTW, the definition of
    ipAddress-value-equal says that "Any portrange values in either
    argument SHALL be ignored", but an ipAddress-value does not have a
    portrange, it has a port.

    

    Best regards,

    Erik

    

    
On 2014-03-19 20:54, John Tolbert
      wrote:

    

     Submitter's message

      All feedback received thus far has been incorporated. Please
      review. Volunteers needed to generate sample XACML policies for
      examples 4.1.2 to 4.2.2. Thanks 

      -- Mr. John Tolbert
      
        
          

             Document Name:
              DLP-NAC
                profile

               Description

              Working draft 05. 

              Download
                Latest Revision

              Public
                Download Link

               Submitter:
              Mr. John Tolbert

              Group: OASIS eXtensible Access Control
              Markup Language (XACML) TC

              Folder: Specifications and Working Drafts

              Date submitted: 2014-03-19 12:54:23