Subject: [babel] HMAC for Babel in Bird

From: Toke Høiland-Jørgensen <[email-masked]>
Date: Fri, 13 Jul 2018 18:16:43 +0200

Hey everyone

I have just finished my proof of concept implementation of HMAC for
Babel as specified in draft-do-babel-hmac-00. The result is in the
'babel-hmac' branch of this git repository:

https://github.com/tohojo/bird

The implementation uses the existing HMAC libraries in Bird, and so
supports MD5, SHA-1, SHA-224, SHA-256, SHA-384 and SHA-512 as hashing
algorithms; it will default to SHA256 as specified in the draft.

I have verified that the implementation can exchange HMAC-signed packets
with the HMAC-enabled babeld branch that Juliusz announced earlier. To
do this, it needs to be configured with a SHA-1 key, and the babeld
implementation needs to be fixed to use the pseudo-header format
specified in the draft (it currently switches the source and destination
addresses in the pseudo-header). An example config for Bird to achieve
this is (only the protocol config):

protocol babel {
    interface "veth0" {
        authentication hmac;

        # babeld insists that an HMAC key must be 20 bytes long; the HEX
        # equivalent (to be used in the babeld config) for this key is
        # 7465737474657374746573747465737474657374
        password "testtesttesttesttest" { algorithm hmac sha1; };
    };
}

I'll post some comments on the draft in the other thread discussing
outstanding issues.

-Toke

---

From: Juliusz Chroboczek <[email-masked]>
Date: Sat, 14 Jul 2018 00:14:19 +0200

> Babel as specified in draft-do-babel-hmac-00.

Congratulations, Toke!  And thanks a lot.

(More comments to follow once I've spoken with the ladies.)

-- Juliusz