Subject: [babel] info-model: multiple instances of hmac/dtls for same interface

From: "STARK, BARBARA H" <[email-masked]>
Date: Mon, 25 Feb 2019 15:24:14 +0000

> > Do you prefer option 1 (to apply to all interfaces, list all
> > interfaces) or option 2 (Boolean to apply to all interfaces)?
> 
> I think it's good to be able to say that a key applies to all interfaces, especially
> if the set of available interfaces can vary dynamically.

I'm putting this "applies to all interfaces" Boolean into the model, and I'm trying to figure out whether it should be possible to have multiple instances if there is an instance with this flag set, and whether it should be possible for an interface to be listed in multiple instances (when the flag is false).
In all cases, if "applies to all interfaces" is true, the list of interfaces inside the same object instance is ignored.

Possibilities:
1. If there is an instance with the "apply to all" flag "true", then no other instances are allowed;
if there is no instance with "apply to all" flag "true", then an interface is only allowed to be listed in one interface list.
2. Instances are additive. For HMAC: when a packet is received on an interface, the HMAC keys of instances with ("apply to all" = "true" or this interface in its list) AND babel-hmac-verify = true AND babel-hmac-key-use-verify = true are used to verify the received packet. When a packet is sent on an interface, the HMAC keys of instances with ("apply to all" = "true" or this interface in its list) AND babel-hmac-key-use-sign = true are used to hash the sent packet.

For HMAC, possibility 2 would be do-able, but maybe not needed? For DTLS, I think it would be much harder to create a good rule, because of the dtls-cached-info and dtls-cert-prefer options (that influence handshaking messages). It wouldn't work to have different settings in different instances that apply to the same interface -- which would mean additional rules would be needed to restrict different values of these parameters. Which gets complicated.
For DTLS, I'd prefer to keep it simple with possibility 1.

Thoughts?
Barbara

---

From: Toke Høiland-Jørgensen <[email-masked]>
Date: Wed, 27 Feb 2019 22:56:19 +0100

"STARK, BARBARA H" <[email-masked]> writes:

> For HMAC, possibility 2 would be do-able, but maybe not needed?

So consider a setup where you have N interfaces that all share the same
key(s), and where one of those interfaces (let's call it X) uses an
additional key (because that is where you keep your dev box, or
something). In this case we'd probably want it to be possible to keep
the shared keys in a "global" instance, and have an additional instance
attached to only interface X.

-Toke