Exclusivity: Implementing network layer security

[TaukSnarkyAgrud]

Any plans to implement exclusivity through network layer security or transport layer?
Would that be too much to ask of the hardware constraints or the power consumption expectations?
Mainly my concern is that nodes that assume the role of Router or Repeater do not ignore broadcasts from nodes that aren’t whitelisted. Could pose an adversarial challenge or just cause unnecessary congestion. Maybe a way to prioritize messages, at the least instead of completely excluding them?

[TaukSnarkyAgrud]

Seems like I may have overlooked the extra configuration for Local_Only and Known_Only. I’ll remove this post after further review.

[TaukSnarkyAgrud]

After further review I still have two concerns:

1. The Local_Only and Known_Only configurations rely on having keys available on the node to decrypt the messages, allowing the determination to exclude/include. I suppose physical security and disabling Bluetooth/Wifi can cover that issue.
2. The Known_Only configuration seems to be the same as Local_Only. The extra step it takes would only be valid if the NodeDB becomes frozen after activating this configuration OR the node based exclusion happens before checking if the message is valid. If a valid message comes in from an unknown node then wouldn’t the node be added to the NodeDB?

Honestly I’m working this out right now so it seems to me that I have my answers. Physical security covers the first concern and the second has to be that foreign nodes can’t be added, even if broadcasting valid messages, due to the exclusion happening immediately after a NodeDB contains check so effectively the NodeDB is frozen.

If anyone could validate this for me or enlighten me I would greatly appreciate it. Thanks!

[TaukSnarkyAgrud]

Verified

[TaukSnarkyAgrud]

I verified the behavior by running a test as follows:
Cleared a node and set it to have the same config as the client node except role: REPEATER and rebroadcastmode:5(KNOWN_ONLY)
The message didn't go through and the node was not added to the db
Then set to LOCAL_ONLY as control and the node was eventually added and the message arrived.
Closing this as it has been resolved.