Received-SPF: pass (google.com: best guess record for domain of linux-bluetooth-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Mon, 16 Sep 2019 11:58:45 +0200
From:   =?utf-8?Q?Micha=C5=82?= Lowas-Rzechonek 
        <michal.lowas-rzechonek@silvair.com>
To:     Brian Gix <brian.gix@intel.com>
Cc:     linux-bluetooth@vger.kernel.org, inga.stotland@intel.com
Subject: Re: [PATCH BlueZ 1/1] mesh: Add local/remote bools to DevKey
 transactions
Message-ID: <20190916095845.htvyalekgr4k2ybt@mlowasrzechonek2133>
Mail-Followup-To: Brian Gix <brian.gix@intel.com>,
        linux-bluetooth@vger.kernel.org, inga.stotland@intel.com
References: <20190915081408.18116-1-brian.gix@intel.com>
 <20190915081408.18116-2-brian.gix@intel.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <20190915081408.18116-2-brian.gix@intel.com>
User-Agent: NeoMutt/20180716
Sender: linux-bluetooth-owner@vger.kernel.org
Precedence: bulk

Hi Brian,

On 09/15, Brian Gix wrote:
> DevKey operations require authorization on the part of the applications
> making the requests. Messages to state changing Servers should use keys
> from the local Key Database to demonstrate authority.

Alright, so if I understand this correctly:

1. If the application would like to change Config Server states on the
   local node, it would need to:
    - call ImportRemoteNode, passing the address of a *local* node and
      the device key obtained from provisioner
    - call DevKeySend to a *local* address, with remote flag set to true
    - receive responses via DevKeyMessageReceived from *local* node,
      with remote flag set to true

   Essentially this means that talking to a local node using device
   security behaves in the same manner as if the node was a remote one.

2. If the application would like to implement an external model that
   uses device security, it would:
    - receive DevKeyMessageReceived calls from remote nodes, with remote
      flag set to false
    - send responses by calling DevKeySend to a *remote* address with
      remote flag set to false

This means that calling DevKeySend to a *local* address with remote flag
false would be forbidden, in order to force the application to use
ImportRemoteNode first?

-- 
Michał Lowas-Rzechonek <michal.lowas-rzechonek@silvair.com>
Silvair http://silvair.com
Jasnogórska 44, 31-358 Krakow, POLAND