search

oasis-tcs / openc2-apsc-stateless-packet-filter

OASIS OpenC2 TC: A GitHub repository is to provide configuration management and to aid in the development of the first generation OpenC2 firewall profile
https://github.com/oasis-tcs/openc2-apsc-stateless-packet-filter
Other
6 stars 10 forks source link

SLPF Response #122

Closed alevere closed 4 years ago

alevere commented 4 years ago

An issue for some environment is determining which actuator responded if an orchestrator receives three responses that appear similar (200 ok). I propose we require an SLPF to return asset_id or asset_tuple in order to determine what device sent a response. Helpful when true source is hidden (NAT, LB) or when using a broadcast/message bus.

Vasileios-Mavroeidis commented 4 years ago

agree.

Just to add some context. This is an issue when we send ONE command to multiple actuators. The UUID of the command is the same, so in the case of 3 responses, no matter if they are successful or not we don't know which response applies to a particular actuator since all of them use the same identifier.

jmbrule commented 4 years ago

This is an issue that will be common to a lot of profiles in systems that have a pub/sub or multicast. Having an 'actuator' field in the response makes sense to me. Question, should we close the issue here and reopen it on the language channel?

Vasileios-Mavroeidis commented 4 years ago

Yep, this is a general issue. It should be handled at the language-spec level

jmbrule commented 4 years ago

Alex, I do not feel good about closing this issue and reopen on the LSC because you brought it up and I think it would be disrespectful of me to close your issue. Do you agree with me and Vasileios, and if so will you close this one and move to LSC?

jmbrule commented 4 years ago

@alevere , will you read over this thread and let me close it here and reintroduce it at the Lang level?

alevere commented 4 years ago

That makes sense to me, sorry for missing this.