SLPF Note

["Everett, Alex D" <alex.everett@unc.edu>]

All,

A few meetings ago we discussed directionality as it pertains to the packet filtering actuator. On this topic, I have some suggested clarifications that I would like to get into the spec. Also at the next meeting I would like to discuss issue #113, which deals with changing the default direction to ingress. Please let me know any comments and I will plan to make a pull request for this near the next meeting with your input.

Type: Direction (Enumerated)

î

ID	Name	Description
1	both	Apply rules to all traffic
2	ingress	Apply rules to incoming traffic only
3	egress	Apply rules to outgoing traffic only

Direction is required by some packet filters. For a host-based or host interface-based packet filter, inbound indicates a packet that originated from a different host. For a network-based packet filter ,such as a router or a switch, ingress indicates a packet entering a physical or logical interface that your organization controls.

pkt ----> to Host (ingress)

<--- pkt generated by Host (egress)

pkt ----> eth0_Router_eth1---->Host/s (ingress to eth0, egress from eth1)

Reference:

https://github.com/oasis-tcs/openc2-apsc-stateless-packet-filter/issues/113

Default Direction  Issue #113  oasis-tcs/openc2-apsc-stateless-packet-filter I propose that default direction is changed from "both" to "ingress" . If the directional argument is not specified, it shall be assumed the intended direction is either not app... github.com

Sincerely,

Alex Everett