Re: [babel] Comments about rfc7298bis

[Juliusz Chroboczek <[e-mail]>]

> As far as I see after thinking about this new input for a day, the
> principal way to fix this would be to mandate that TS/PC number must be
> increasing across the lifetime of a speaker (7298-bis Section 5.1 item
> (a) goes away, item (c) becomes the recommended default, item
> (b) refines the requirements for the timestamp source).

A: Hello, Update(X), TS/PC=42

The packet is captured by C.  At this point, A and B simultaneously reboot
and loose their ANM state.

C spoofing A: Hello, Update(X), TS/PC=42

Since B has lost its ANM state, it accepts this packet as authentic, and
learns a spoofed route to X through A.  At which point, an (authentic)
Hello/IHU exchange happens:

B: Hello, TS/PC=57
A: Hello, IHU(B, TS/PC=57), TS/PC=43

B's cost to A becomes finite, and the replayed route is installed.

Note that I'm not sure that this is a serious attack -- C has managed to
get B to route through A, it has not managed to redirect traffic through
itself.

> A secondary measure would be to have a large ANMTimeout by default
> (since item (a) no longer applies) and to save ANM table across reboots,

If we assume that the ANM table is persistent, then a lot of things become
much easier.  Another solution would be to assume that all nodes have
real-time clocks, and require that TS/PC carries a timestamp that's no
more than 20 seconds in the past.

However, I think a more general fix is possible -- the attack above is due
to B accepting a (spoofed) packet from A although it has no recent ANM
state for A.

-- Juliusz