Re: The 802.15.4 Security Layer

[Alexander Aring <alex.aring@gmail.com>]

Hi,

On Tue, Jun 23, 2015 at 04:34:42PM +0100, Simon Vincent wrote:
> Hi Alex,
> 
> Do you have your security/nl802154 work available anywhere I can have a
> look?
> I am in the process of getting 802.15.4 security working on our devices. I
> don't want to implement it using the old interface as I will then have to
> recode our application when llsec moves over to nl802154.

I think what we do at first is a 1:1 implementation of the old interface
and the new interface and then look what we can change afterwards if
needed.

We introduce then some CONFIG_NL802154_EXPERIMENTAL to change the enum
definition (with security and without). I think then we are somehow
safe to still change the netlink interface, inside kernelspace, afterwards.

> I have some spare time at the moment to develop/review/test the security
> layer.
> 

Too bad I have at the moment really nothing which you can test/review
maybe we can do some split working of development tasks, but I don't have
the overview at the moment to split anything.

For general I would say somebody can do the userspace side and another one
can do the kernelspace side. At the end we trying to fit anything together.

For me it's _very_ important that the userspace side should not have
some big mechanism to setup the kernelspace stuff. We should provide
some config file to setup the most part, instead doing iwpan calls over
command line.

Phoebe also reported that we need to save the current dump of the whole
security information in case of a reboot and restore them afterwards
again. (e.g. the frame counter attribute). This all smells more like a
daemon which running in the background and deals with some configfiles
and states (dumping security tables in case of reboot).

- Alex