Our Blog
A kill switch that fails closed
Lorem ipsum dolor sit amet consectetur. A kill switch is judged on what it does while nothing is working, which is the state nobody tests because it is uncomfortable to reproduce on purpose.
The three states
Nullam sed tellus pharetra egestas vitae consectetur adipiscing.
- Up. Traffic is in the tunnel and there is nothing to decide.
- Down and known to be down. Everything is dropped, which is the easy case.
- Down and not yet known to be down. This is the one that leaks.
Failing closed by default
Sed do eiusmod tempor incididunt ut labore et dolore. The third state is handled by making the closed position the resting position: the route is installed before the tunnel comes up and removed after it goes down, so there is no window in which the operating system has a default route and we do not.
