Re: [radext] configuration auto-discovery [was: draft-cullen-radextra-status-realm-00]

[Alexander Clouter <[e-mail]>]

On Mon, 14 Aug 2023, at 15:38, Alan DeKok wrote:
>
> * RADIUS cannot signal "please send this packet on a different route".

...pure spit balling.

Say we invent a new type of RADIUS reject...call it 'Access-Unreachable'.

Not important here and now, as it is detail, but this packet could have a 'scope' to communicate if this is just the realm the Access-Request was for or "all realms" or something in between.

>   The difficulty is that the servers here are proxies.  If they were 
> home servers, then when server A is dead, the client simply falls back 
> to server B.
>
>   But when we have proxies, server A is alive, but can't forward 
> packets for a particular realm.  But maybe server B can forward those 
> packets.  This last piece is what drives the idea of a realm routing 
> protocol.

With our new response packet we can have each proxy take part in a *depth*-first search primed by the existing administrative file/DNS/database setup.

A >--+--- B --+-- C --- D --+--> E
     |        |             |
      \-- W --+-- X --- Y --/

So A is trying to get to E.

 * System D is dead: C responds to B "unreachable" and B can then try X. If X is dead, it will response "unreachable" to A which will try W.
 * System C is dead: B will respond to A "unreachable" and 
 * System E is dead: D will response to C and the C to B "unreachable". B will try X which will get "unreachable" from Y. B responds to A "unreachable" causing it to try "W" and it will end up with "unreachable" from X

This is not really routing, but just building a dynamic filter list of when *not* to use your configured proxy upstream.

Things then backtrack until they get through. Actually, lets call the packet Access-Cut for the Prolog fans out there :)

The tricky part would be figuring out when to unblock traffic to the upstream by realm. This probably would be a good fit for regularly polling Status-Realm with the TTL set to one.

This would be an optimisation effort. The system would have to discover unreachable before it can start reporting unreachable downstream.

Time now for the "Smithers Release The Hounds" stage and have this idea torn apart.

Cheers