Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

router: feature toggle for experimental SCMP authentication #4418

Merged
merged 1 commit into from
Oct 12, 2023

Conversation

matzf
Copy link
Contributor

@matzf matzf commented Oct 10, 2023

The experimental implementation of DRKey-based authentication for SCMP messages is incomplete and, in the current form, not practically useful. Add a feature flag to explicitly opt-in to the experimental SCMP authentication in the router.


This change is Reviewable

Copy link
Contributor

@JordiSubira JordiSubira left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed 5 of 5 files at r1, all commit messages.
Reviewable status: all files reviewed, 2 unresolved discussions (waiting on @matzf)


doc/manuals/router.rst line 98 at r1 (raw file):

   Override the global duration for :doc:`/cryptography/drkey` epochs.
   This environment variable also applies to :program:`control`, see :envvar:`SCION_TESTING_DRKEY_EPOCH_DURATION`.

Perhaps include also cross-reference from manuals/control.html#envvar-SCION_TESTING_DRKEY_EPOCH_DURATION?


doc/manuals/router.rst line 101 at r1 (raw file):

   :Type: :ref:`duration <control-conf-duration>`

:Default: 24h?

Copy link
Contributor Author

@matzf matzf left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewable status: 4 of 6 files reviewed, 2 unresolved discussions (waiting on @JordiSubira)


doc/manuals/router.rst line 98 at r1 (raw file):

Previously, JordiSubira wrote…

Perhaps include also cross-reference from manuals/control.html#envvar-SCION_TESTING_DRKEY_EPOCH_DURATION?

Done. I've opted to make cross-references to the "Environment Variable" section instead of the individual envvar. It'd could be made to work with references to the individual envvar block, but it would likely become a bit unwieldy once this should be done with envvars that are shared between more than two components.


doc/manuals/router.rst line 101 at r1 (raw file):

Previously, JordiSubira wrote…

:Default: 24h?

Done.

Copy link
Contributor

@JordiSubira JordiSubira left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed 2 of 2 files at r2, all commit messages.
Reviewable status: all files reviewed, 1 unresolved discussion (waiting on @matzf)


doc/manuals/router.rst line 103 at r2 (raw file):

   Also applies to the :ref:`control service <control-envvars>`.

   :Type: :ref:`duration <common-conf-duration>`

control

Code quote:

common

The experimental implementation of DRKey-based authentication for SCMP
messages is incomplete and, in the current form, not practically useful.
Add a feature flag to explicitly opt-in to the experimental SCMP
authentication in the router.
@matzf matzf force-pushed the router-cfg-scmp-auth branch from 662ec49 to c5862f3 Compare October 12, 2023 12:06
Copy link
Contributor Author

@matzf matzf left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewable status: 4 of 6 files reviewed, 1 unresolved discussion (waiting on @JordiSubira)


doc/manuals/router.rst line 103 at r2 (raw file):

Previously, JordiSubira wrote…

control

Done (was overlapping change from #4416 and oversight when applying that change to this branch -- no longer relevant after merging 4416).

Copy link
Contributor

@JordiSubira JordiSubira left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

:lgtm:

Reviewed 2 of 2 files at r3, all commit messages.
Reviewable status: :shipit: complete! all files reviewed, all discussions resolved (waiting on @matzf)

@matzf matzf merged commit 44c2f67 into scionproto:master Oct 12, 2023
1 check passed
@matzf matzf deleted the router-cfg-scmp-auth branch October 12, 2023 12:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants