Subject: [babel] partial trust?

From: Dave Taht <[email-masked]>
Date: Fri, 29 Jun 2018 09:37:00 -0400

Presently authentication seems intended as an all or nothing procedure.

It would be useful to be able to have some nodes still available to route,
but not participating in the authentication protocol. (old nodes that
cannot be updated, new nodes as yet unconfigured, nodes on other
folk's systems, etc).

The only way I can think of implementing this halfway would be to
inflate the metrics received from unauthenticated sources by 32768 or
some other really high value.

-- 

Dave Täht
CEO, TekLibre, LLC
http://www.teklibre.com
Tel: 1-669-226-2619

---

From: Ted Lemon <[email-masked]>
Date: Fri, 29 Jun 2018 10:45:19 -0500

Why not just update the firmware?

On Fri, Jun 29, 2018 at 8:36 AM Dave Taht <[email-masked]> wrote:

> _______________________________________________
> babel mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/babel
>

---

From: Juliusz Chroboczek <[email-masked]>
Date: Sat, 30 Jun 2018 00:56:18 +0200

Dave!

> cannot be updated, new nodes as yet unconfigured, nodes on other

Note that we haven't implemented key rotation yet, so we're pretty far
from supporting graceful transition from an unauthentified network to an
authentified one.

> some other really high value.

Babel supports fairly arbitrary route selection policies, so we can prefer
authentified routes without tweaking the metric.  We could use a sub-TLV
to carry the authentication status of a route, end-to-end.

I'd like your use-case precisely described first, though.

-- Juliusz