Subject: [Mud] Disambiguating MUD rules

From: "M. Ranganathan" <[email-masked]>
Date: Thu, 13 Jun 2019 15:22:45 -0400

If there are two ACE's in a MUD rule, one for say "controller" and another
for, "local-networks", how should these be disambiguated?

1. Most permissive rule wins.
2. Least permissive rule wins.
3. A host designated as a "controller" is not part of the "local-network"
classification.
4. This is a network admin concern.
5. This is a network configuration error and the MUD server should reject
it.

If there's some guidance in the mud spec on how to disambiguate such
situations?

Thanks,

Ranga

-- 
M. Ranganathan

---

From: "M. Ranganathan" <[email-masked]>
Date: Thu, 13 Jun 2019 15:59:19 -0400

Forgot to add one thing:

In this case, the controller host is also on the "local network" (e.g. on
the same subnet ).

Thanks

-- 
M. Ranganathan

---

From: Eliot Lear <[email-masked]>
Date: Thu, 13 Jun 2019 22:02:51 +0200

> On 13 Jun 2019, at 21:22, M. Ranganathan <[email-masked]> wrote:
> 
> If there are two ACE's in a MUD rule, one for say "controller" and another for, "local-networks", how should these be disambiguated?

In the same ACE?  It shouldn’t happen.  The spec doesn’t explicitly say so, however.  I view that as an erratum.  A way of looking at this is that there should be at most one host abstraction.

Eliot

> 3. A host designated as a "controller" is not part of the "local-network" classification.
> 5. This is a network configuration error and the MUD server should reject it.
> 
> If there's some guidance in the mud spec on how to disambiguate such situations?
> 
> Thanks,
> 
> Ranga
> 
> --
> M. Ranganathan
> 
> --
> Mud mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mud