Subject: [OPSAWG] MUD: Why reserve names for "well-known" controllers

From: "M. Ranganathan" <[email-masked]>
Date: Wed, 18 Oct 2017 18:19:50 -0400

Hello MUD authors,

DNS and NTP have reserved URI names. However, it appears you need to
specify a full ACL for both of these. In that case, why reserve the name?
Is it just for clarity?

Thanks

-- 
M. Ranganathan

---

From: "M. Ranganathan" <[email-masked]>
Date: Thu, 19 Oct 2017 10:28:46 -0400

Hello,

> specify a full ACL for both of these. In that case, why reserve the name?

On thinking things through carefully, I concluded that indeed it is
necessary to use a reserved URI for DNS  server. This is because SAME name
resolution has to be applied both by the device and the MUD controller.
This URI identifies the DNS  server used by the IOT device so that the MUD
controller may apply the same name resolution to the DNS ACLs that it
installs.

I am not clear in my mind about why this should be the case for NTP server
i.e. why do we reserve a special URN for NTP server? Why is it not just a
"controller" like every other one?

Thank you in advance for your clarifications.

Regards,

Ranga

-- 
M. Ranganathan

---

From: Eliot Lear <[email-masked]>
Date: Thu, 19 Oct 2017 22:44:01 +0200

Hi Ranga,

Sorry I've been quiet for a few days.  I'll have more to say later. 
Please see below.

> "controller" like every other one?

The base assumption we had was that everyone needs name resolution and
time.  Also, if you standardize these names, it's easy for
implementations to simply fill in the values, if they happen to know
them.  So for instance, during install of your controller, you might
simply ask, “Should I include the local NTP servers I found in my
ntp.conf files and DNS servers I found in /etc/resolve.conf?”

Eliot

---

From: "M. Ranganathan" <[email-masked]>
Date: Thu, 19 Oct 2017 20:47:54 -0400

Hi Eliot,

> ntp.conf files and DNS servers I found in /etc/resolve.conf?”
I thought the motivation in specifying a well-known URI for DNS is that the
IOT device should do the SAME name resolution as the entity that installs
the ACLs and for this to happen we need to specify that they both use the
same DNS server.

Scenario: Perhaps the manufacturer would like the IOT devices to use HIS
name server - not necessarily what is returned by  dhcp when the IOT device
goes to get it's IP address assigned. That is the device gets a server
address of the desired name server somehow when it connects to its
controller. This would be a guard against DNS spoofing. The mud controller
needs to be able to install ACLs that allow the device to talk to the DNS
server - hence the idea of a URI mapping made sense because, the entity
that installs the ACLs (i.e. the Mud controller) should use the SAME name
resolver to result in the same name resolution.

The draft also says - LAN local DHCP and DNS should always be allowed.
These are allowed by default. The mechanism to communicate these to the MUD
controller is not specified in the draft.

Still not clear about the need to make NTP a "well known URI" but I'll
assume this is for convenience.

-- 
M. Ranganathan

---

From: Eliot Lear <[email-masked]>
Date: Fri, 20 Oct 2017 07:02:58 +0200

> resolver to result in the same name resolution.

In this case, you can treat DNS as any other service and just use a DNS
ACL with something like DOH.

> controller is not specified in the draft.
s/DHCP/NTP, and yes, that is stated that they are to be allowed by
default.  It is the responsibility of the controller to instantiate
appropriate ACLs to allow for that.

Eliot