Re: [B.A.T.M.A.N.] dublicate HNAs / certificates

[Alexander Morlang <alx@dd19.de>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Axel Neumann schrieb:
> HI,
> 
> I like brainstorming like this.
> We wanted batmand (and especially its core routing algorithm) to be decentral 
> and simple. So no central point of control/failure and therefore also no HNA 
> server. Of course there are many potential attack vectors in a community mesh 
> and probably there will always be until you completely restrict the access. 
> Therefore IMHO the preferable security to be solved should be:
> 
> - detect and protect against (usually accidental) misconfigurations like 
> duplicate addresses.
> 

sure, a duplicate address is something the routingprotocoll has to
detect and to react on, but:
duplicate HNA are very importand and widely accepted in the internet
community, they are called anycast and are a vital instrument in network
design and deployment.

as an example, anycast ist used for dns root servers, 6to4 tunnel and
many other usecases.

i am still not understanding why you are discussing about removing such
important thing as anycast.

anycast is a way to use distributed services, as you can announce an
anycast address on every node, providing a specific service and packets
will get routed to the nearest service provider.

> - find mechanisms to limit the impact of denial of service or other attacks to  
> the local environment (neighborhood).
> 

<removed>

Gruss, Alex
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkljYz0ACgkQhx2RbV7T5aESngCgm0gopTcK+C17sHB29nz4jfsY
5JcAmgIS2EXnvL37QfFU/mAxnBRAQDMe
=nJZR
-----END PGP SIGNATURE-----