Re: [Anima-bootstrap] DRAFT minutes up to 2016-09-13

[Michael Richardson <[e-mail]>]

Brian E Carpenter <[e-mail]> wrote:
    >> Brian E Carpenter <[e-mail]> wrote:
    >> >> Brian E Carpenter <[e-mail]> wrote:
    >> >> >> I) The ANIMA cast list is as follows:
    >> >> >> i) pledge is TCP-initiator, TLS-client, HTTP/EST client.
    >> >> >> ii) registar is TCP-responder, TLS-server, EST server.
    >> >>
    >> >> > Where's the proxy in that? And didn't we say we'd also have a COAP option?
    >> >>
    >> >> The proxy is in between, but doesn't provide functions above layer-3ish.
    >> >> I ommited it for clarity :-)
    >>
    >> > OK. But layer 4 probably - it seems likely that we would terminate a TLS
    >> > session at the proxy and make another one between the proxy and the
    >> > registrar. (That's the bit I *didn't* model in my Python demos.)
    >>
    >> No, we don't want to do that for a number of reasons:

    > So, accepting those reasons, if (for example) we do the first
    > suggestion in draft-richardson-anima-state-for-joinrouter-01:

    > "3.1.  method 1: Circuit Proxy method

    > In response to discovery, the circuit proxy would return a link-local
    > address on the joining router.  The joining router would have a TCP
    > (or UDP/CoAP) port open on that interface.  It would accept
    > connections on that port, and would turn around and create a new TCP
    > connection to the registrar."

    > Can TLS just ride over such a relayed TCP connection?

Yes, the circuit proxy plugs two layer-4s together.
TLS is a "layer-5" here. It just goes through, unexamined, by the proxy.

    > And so on for the other models in anima-state-for-joinrouter. I do
    > think this needs to be resolved before we can say the model is complete.

    > Brian


--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-