Received-SPF: pass (google.com: best guess record for domain of linux-bluetooth-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   "Gix, Brian" <brian.gix@intel.com>
To:     =?windows-1250?Q?Micha=B3_Lowas-Rzechonek?= 
        <michal.lowas-rzechonek@silvair.com>
CC:     "linux-bluetooth@vger.kernel.org" <linux-bluetooth@vger.kernel.org>,
        "Stotland, Inga" <inga.stotland@intel.com>
Subject: Re: [PATCH BlueZ 1/1] mesh: Add local/remote bools to DevKey
 transactions
Thread-Topic: [PATCH BlueZ 1/1] mesh: Add local/remote bools to DevKey
 transactions
Thread-Index: AQHVa52TiigZ9MdeYUO+JqwhakK/NqcuiMWA//+an5Y=
Date:   Mon, 16 Sep 2019 10:55:54 +0000
Message-ID: <8DD9DDA0-1081-479F-B215-2E815B1A8F27@intel.com>
References: <20190915081408.18116-1-brian.gix@intel.com>
 <20190915081408.18116-2-brian.gix@intel.com>,<20190916095845.htvyalekgr4k2ybt@mlowasrzechonek2133>
In-Reply-To: <20190916095845.htvyalekgr4k2ybt@mlowasrzechonek2133>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="windows-1250"
Content-Transfer-Encoding: 8BIT
MIME-Version: 1.0
Sender: linux-bluetooth-owner@vger.kernel.org
Precedence: bulk

Hi Micha?, 

> On Sep 16, 2019, at 11:58 AM, Micha? Lowas-Rzechonek <michal.lowas-rzechonek@silvair.com> wrote:
> 
> Hi Brian,
> 
>> On 09/15, Brian Gix wrote:
>> DevKey operations require authorization on the part of the applications
>> making the requests. Messages to state changing Servers should use keys
>> from the local Key Database to demonstrate authority.
> 
> Alright, so if I understand this correctly:
> 
> 1. If the application would like to change Config Server states on the
>   local node, it would need to:
>    - call ImportRemoteNode, passing the address of a *local* node and
>      the device key obtained from provisioner
>    - call DevKeySend to a *local* address, with remote flag set to true
>    - receive responses via DevKeyMessageReceived from *local* node,
>      with remote flag set to true
> 
>   Essentially this means that talking to a local node using device
>   security behaves in the same manner as if the node was a remote one.
> 
> 2. If the application would like to implement an external model that
>   uses device security, it would:
>    - receive DevKeyMessageReceived calls from remote nodes, with remote
>      flag set to false
>    - send responses by calling DevKeySend to a *remote* address with
>      remote flag set to false
> 
> This means that calling DevKeySend to a *local* address with remote flag
> false would be forbidden, in order to force the application to use
> ImportRemoteNode first?

I think that is all basically correct. I switched the Boolean bit-sense  such that the boolean parameter is ?remote? on the send and ?local? on the receive.

And most importantly, your last point is an emphatic yes....    you will need to import your own device key to the key ring if you want to talk to your own builtin servers.  The one exception will be nodes that have called ?Create()? which are generating brand new mesh networks with themselves as unicast 0001.


> 
> -- 
> Micha? Lowas-Rzechonek <michal.lowas-rzechonek@silvair.com>
> Silvair http://silvair.com
> Jasnog?rska 44, 31-358 Krakow, POLAND