Re: [Anima-signaling] GRASP issue 52: Insecure instance text

[Brian E Carpenter <[e-mail]>]

On 02/08/2016 23:54, Toerless Eckert wrote:
> On Tue, Aug 02, 2016 at 02:26:51PM +1200, Brian E Carpenter wrote:
>>>   SONN - Secure Only Neighbor Negotiation 
>>>       For use when negotiating (securely) an ACP channgel:
>>>       loopcount=1 only. All messages permitted. 
>>
>> Does that really need to be a separate instance? It can be controlled
>> completely via the API.
> 
> How ? How would i inhibit that anything but the ACP-negotiation (TBD) objective
> is going to be offered ? Lets assume inside the ACP the nodes do have
> a bunch of other objectives they offer.

When do you expect to use this instance? Only when a node initially joins
the ACP, or at any time (e.g. if a new link comes up)?

> Also: Assume i have between two ACP nodes two parallel links, and the nodes
> do have on both links the same link-local IPv6 addresses. For Objectives
> of the ACP instnce of GRASP i do not care about those link-local addresses,
> all ACP objectives should be bound to the routeable ULA off the AN node.
> But when setting up the ACP in parallel across both links, then that has
> to use the link-local addresses. Which would be overlapping.

Well, they should always be distinguished by the interface ID; that is always
available in the socket interface*. So I think you can have one instance that
handles all interfaces.

*However, the way you discover it is different in Posix and Winsock.

> This problem is solved for free when we define those ACP setup GRASP to be
> separate instances on every interface in the same way as the DULL (insecure)
> instances are.

Well, you still need to discover which interfaces you have, before you create
those instances. So I'm not convinced there is any benefit in one instance
per interface.

Rgds,
    Brian
> 
> Cheers
>     Toerless
> 
>> Regards
>>    Brian
>>
>> On 01/08/2016 21:29, Toerless Eckert wrote:
>>> Maybe Max has more details, he did take some notes.
>>>
>>> >From my side:
>>>
>>> - Define different "Modes" of GRASP, where each Mode has
>>>   specific limitation (or none). Every Instance of GRASP has a particular Mode:
>>>
>>>    DULL - Discovery Unsolicited Link Local
>>>
>>>      This is the "insecure" mode, aka: Only Unsolicited Link Local Discovery Response
>>>      Messages are permitted. Loop Count = 1. No redirects are permitted.
>>>
>>>      (i don't think we need to constrain the announcements further to only bootstrap
>>>       proxy etc. This should be nicely reuseable for any similar announcements, not
>>>       only bootstrap proxy).
>>>   
>>>    FULL - Instance inside ACP. No restrictions.
>>>
>>>    SONN - Secure Only Neighbor Negotiation 
>>>       For use when negotiating (securely) an ACP channgel:
>>>       loopcount=1 only. All messages permitted. 
>>>
>>> Cheers
>>>     Toerless
>>>
>>> On Mon, Aug 01, 2016 at 09:01:56AM +1200, Brian E Carpenter wrote:
>>>> Hi,
>>>>
>>>> Here's another issue for design team comments.
>>>>
>>>> I have a specific request from the bootstrap team to described in detail
>>>> what is allowed and disallowed in an insecure instance of GRASP. The idea is
>>>> that during bootstrap a separate instance of GRASP will run in its own memory
>>>> space, such that it cannot contaminate the normal secure instance. For example
>>>> it will have its own discovery cache. I will work on the text as soon as
>>>> possible, based on some input from Max Pritikin. Any input welcome.
>>>>
>>>> Regards
>>>>    Brian
>>>>
>>>> _______________________________________________
>>>> Anima-signaling mailing list
>>>> [e-mail]
>>>> https://www.ietf.org/mailman/listinfo/anima-signaling
>>>
>