Re: [Mud] Convening MUD calls, + next steps

[Eliot Lear <[e-mail]>]

> On 14 May 2019, at 21:03, M. Ranganathan <[e-mail]> wrote:
> 
> Hello Eliot,
> 
> On Tue, May 14, 2019 at 7:37 AM Eliot Lear <[e-mail] <mailto:[e-mail]>> wrote:
> Hi Ranga,
> 
> Following up on this message below, the ACL model has actions available.  One of the things we have spoken about was a means by which manufacturers could collect intelligence about how the MUD file is being interpreted.  That is- if the implementation is dropping packets or would drop packets based on the MUD file, provide some sort of aggregate feedback.  We need a draft on that alongside an implementation.
> 
> Defining the format of such feedback would be useful I think.
> 
> 
> We talked a bit about this at one point, and the key is just making sure to match the drop against a particular MUD rule.  From an implementation standpoint that means logging drops, for a specific device, matching that device to a MUD URL, and then having some sort of contact information available for this purpose.
> 
> Request some clarifications on the proposed behavior:
> 
> MUD is a series of "ACCEPT" rules followed by an implicit DROP rule. So how can we know that a specific MUD rule caused a packet to be dropped? All we know when the packet is dropped (or marked for drop) is that NO mud rule allowed the packet to proceed.
> 

On the whole this is generally true.  The fact that the packet was dropped means that NONE of the accept rules were met, and that’s a lot of information right there.  ie, my-controller, same-manufacturer etc didn’t match, or they matched a reject rule.  Do others have thoughts there?

Eliot