Re: [babel] Shepherd Review of draft-ietf-babel-source-specific-04

[Juliusz Chroboczek <[e-mail]>]

>     Babel is a distributed algorithm, and its correctness relies on all nodes
>     in a routing domain behaving correctly.  There are many ways in which
>     a buggy or malicious node can disrupt a Babel network, and an
>     implementation is not required to detect most of them.  (The most common
>     in production is a node that announces a route but doesn't actually
>     forward packets, e.g. due to a mis-configured firewall.)

[...]

> And it is a traditional desiderata in routing protocols in the
> IETF that in a network with mixed implementations, you can't originate a bad
> routing packet from a node and have a persistent loop or conceivably even
> scattered persistent loops form in your network.

I don't think that ideal is achievable.  For example, in OSPF or IS-IS, if
a router corrupts its LSDB, or fails to synchronise it in a timely manner,
then you will get persistent loops.  A similar thing will happen if a BGP
speaker erroneously or maliciously discards part of the AS-path (the
opposite of prepending, in a sense).

I agree with you, though, that even though we cannot handle all cases, we
should identify the cases that are easy to handle and either require or
recommend that a robust implementation avoid burning down the universe
when it receives an erroneous packet that is easy to detect.  My question
to Toke was whether this is one of the easy cases from the point of view
of his implementation.

> For example, if you are parsing a TLV it would be reasonable to set
> a flag when you see a valid Source Prefix sub-TLV and just remember the
> prefix specified, overwriting any previous source prefix seen in that
> TLV.

I agree, this appears to be a case that's easy to handle.

So -- MUST or SHOULD?  (I prefer SHOULD, both Toke and Donald appear to
prefer MUST, so I'll give myself some more time to think it over.)

-- Juliusz