Babel: Add MAC authentication support - update

Some cleanups and bugfixes to the previous patch, including:

 - Fix rate limiting in index mismatch check

 - Fix missing BABEL_AUTH_INDEX_LEN in auth_tx_overhead computation

 - Fix missing auth_tx_overhead recalculation during reconfiguration

 - Fix pseudoheader construction in babel_auth_sign() (sport vs fport)

 - Fix typecasts for ptrdiffs in log messages

 - Make auth log messages similar to corresponding RIP/OSPF ones

 - Change auth log messages for events that happen during regular
   operation to debug messages

 - Switch meaning of babel_auth_check*() functions for consistency
   with corresponding RIP/OSPF ones

 - Remove requirement for min/max key length, only those required by
   given MAC code are enforced

1 files changed, 10 insertions, 12 deletions

diff --git a/proto/babel/config.Y b/proto/babel/config.Y
index 5e0710b5..05210fa4 100644
--- a/proto/babel/config.Y
+++ b/proto/babel/config.Y
@@ -103,26 +103,24 @@ babel_iface_finish:
   {
     struct password_item *pass;
     uint len = 0, i = 0;
+
     WALK_LIST(pass, *BABEL_IFACE->passwords)
     {
       /* Set default crypto algorithm (HMAC-SHA256) */
       if (!pass->alg)
 	pass->alg = ALG_HMAC_SHA256;
 
-      if (pass->alg & ALG_HMAC) {
-        if (pass->length < mac_type_length(pass->alg) ||
-            pass->length > mac_type_block_size(pass->alg))
-          cf_error("key length %d is not between output size %d and block size %d for algorithm %s",
-                   pass->length, mac_type_length(pass->alg),
-                   mac_type_block_size(pass->alg), mac_type_name(pass->alg));
-      } else if (!(pass->alg == ALG_BLAKE2S_128 || pass->alg == ALG_BLAKE2S_256 ||
-                   pass->alg == ALG_BLAKE2B_256 || pass->alg == ALG_BLAKE2B_512)) {
-	cf_error("Only HMAC and Blake algorithms are supported");
-      }
+      if (!((pass->alg & ALG_HMAC) ||
+	    (pass->alg == ALG_BLAKE2S_128) ||
+	    (pass->alg == ALG_BLAKE2S_256) ||
+	    (pass->alg == ALG_BLAKE2B_256) ||
+	    (pass->alg == ALG_BLAKE2B_512)))
+	cf_error("Only HMAC and Blake2 algorithms are supported");
 
       len += mac_type_length(pass->alg);
       i++;
     }
+
     BABEL_IFACE->mac_num_keys = i;
     BABEL_IFACE->mac_total_len = len;
   }
@@ -146,9 +144,9 @@ babel_iface_item:
  | NEXT HOP IPV4 ipa { BABEL_IFACE->next_hop_ip4 = $4; if (!ipa_is_ip4($4)) cf_error("Must be an IPv4 address"); }
  | NEXT HOP IPV6 ipa { BABEL_IFACE->next_hop_ip6 = $4; if (!ipa_is_ip6($4)) cf_error("Must be an IPv6 address"); }
  | AUTHENTICATION NONE { BABEL_IFACE->auth_type = BABEL_AUTH_NONE; }
- | AUTHENTICATION MAC { BABEL_IFACE->auth_type = BABEL_AUTH_MAC; }
+ | AUTHENTICATION MAC { BABEL_IFACE->auth_type = BABEL_AUTH_MAC; BABEL_IFACE->auth_permissive = 0; }
  | AUTHENTICATION MAC PERMISSIVE { BABEL_IFACE->auth_type = BABEL_AUTH_MAC; BABEL_IFACE->auth_permissive = 1; }
- | password_list	{ }
+ | password_list
  ;
 
 babel_iface_opts: