Subject: [Mud] Hackathon topics for IETF 105

From: "M. Ranganathan" <[email-masked]>
Date: Wed, 5 Jun 2019 12:25:27 -0400

There is going to be a "hackathon table" for IETF 105. Here are some ideas
that occurred to me:

- Quarantine : Mechanisms to isolate devices that violate MUD-specified
ACEs.
- Logging and Event notifications : If a MUD-enable device violates its
allowed behavior, one approach is to summarize the violations and send
event notifications to some centralized event-gathering point. What to
report and to whom? Should we incorporate rate specifications so excessive
connections or packet rates can be logged and notified.

Any other candidates?

-- 
M. Ranganathan

---

From: Eliot Lear <[email-masked]>
Date: Wed, 5 Jun 2019 18:54:24 +0200

Hi Ranga,

Validating and cleaning up Mudmaker.  For these below.

> On 5 Jun 2019, at 18:25, M. Ranganathan <[email-masked]> wrote:
> 
> There is going to be a "hackathon table" for IETF 105. Here are some ideas that occurred to me:
> 
> - Quarantine : Mechanisms to isolate devices that violate MUD-specified ACEs.

For hacking… we need to have a good feel for the starting point in terms of how to code.  This looks like it’s tied to logging...

> - Logging and Event notifications : If a MUD-enable device violates its allowed behavior, one approach is to summarize the violations and send event notifications to some centralized event-gathering point. What to report and to whom? Should we incorporate rate specifications so excessive connections or packet rates can be logged and notified.

Right.  What’s the reporting mechanism?  I’m working on a draft for this now, which I will be happy to share in a week or two.  We will need a MUD extension for this (the reporting address).  Michael and I were going back and forth about this.  I do not want to simply say, “URI” because there are too many schemes out there.  We know that email has to be one approach.  Do we want RESTful interfaces as well for these reports?

> 
> Any other candidates?
> 
> 
> 
> --
> M. Ranganathan
> 
> --
> Mud mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mud

---

From: "M. Ranganathan" <[email-masked]>
Date: Wed, 5 Jun 2019 23:43:29 -0400

Hello Eliot,

> Validating and cleaning up Mudmaker.  For these below.

I'd say this would be a pre-hackathon requirement  once the direction is
settled :-)

> For hacking… we need to have a good feel for the starting point in terms
> of how to code.

There was a draft we were discussing earlier (authored by Michael
Richardson). I made a correction and posted an update to this list.

This looks like it’s tied to logging...

Not necessarily (at least not the way I was thinking about it). It is a
mechanism to identify a list of MUD ACEs that are operational for a
MUD-enabled device that violates its intended behavior.

> Right.  What’s the reporting mechanism?  I’m working on a draft for this
> now, which I will be happy to share in a week or two.  We will need a MUD
> extension for this (the reporting address).  Michael and I were going back
> and forth about this.  I do not want to simply say, “URI” because there are
> too many schemes out there.  We know that email has to be one approach.  Do
> we want RESTful interfaces as well for these reports?
>

Restful interfaces would be the most useful. You could, thereby generate an
alert. Also what should be the format for these reports? IPFIX?

-- 
M. Ranganathan