The Optimized Link State Routing Protocol version 2 (OLSRv2) [START_REF] Clausen | The Optimized Link State Routing Protocol Version 2[END_REF] is a successor to OLSR [START_REF] Clausen | Optimized Link State Routing Protocol (OLSR)[END_REF] as a routing protocol for Mobile Ad Hoc Networks (MANETs). OLSRv2 retains the same basic algorithms as its predecessor; however, it offers various improvements, e.g., a modular and flexible architecture allowing extensions (such as for security) to be developed as add-ons to the basic protocol. Such building blocks and modules include [START_REF] Clausen | Jitter Considerations in Mobile Ad Hoc Networks (MANETs)[END_REF], [START_REF] Clausen | Generalized Mobile Ad Hoc Network (MANET) Packet/Message Format[END_REF], [START_REF] Clausen | Representing Multi-Value Time in Mobile Ad Hoc Networks (MANETs)[END_REF], [START_REF] Clausen | Mobile Ad Hoc Network (MANET) Neighborhood Discovery Protocol (NHDP)[END_REF], [START_REF] Herberg | Integrity Check Value and Timestamp TLV Definitions for Mobile Ad Hoc Networks (MANETs)[END_REF], [START_REF] Herberg | Integrity Protection for the Neighborhood Discovery Protocol (NHDP) and Optimized Link State Routing Protocol Version 2 (OLSRv2)[END_REF], [START_REF] Dearlove | Routing Multipoint Relay Optimization for the Optimized Link State Routing Protocol Version 2 (OLSRv2)[END_REF], [START_REF] Dearlove | Optimized Link State Routing Protocol Version 2 (OLSRv2) and MANET Neighborhood Discovery Protocol (NHDP) Extension TLVs[END_REF], [START_REF] Dearlove | An Optimization for the Mobile Ad Hoc Network (MANET) Neighborhood Discovery Protocol (NHDP)[END_REF], etc.

The developments reflected in OLSRv2 have been motivated by increased real-world deployment experiences, e.g., from networks such as FunkFeuer [FUNKFEUER], and the requirements to be addressed for continued successful operation of these networks. With participation in such networks increasing (the FunkFeuer community network has, e.g., roughly 400 individual participants at the time of publication of this document), operating under the assumption that participants can be "trusted" to behave in a non-destructive way, is naive. With deployment in the wider Internet, and a resultant increase in user numbers, an increase in attacks and abuses has followed necessitating a change in recommended practices. For example, SMTP servers, which were initially available for use by everyone on the Internet, require authentication and accounting for users today [START_REF] Hutzler | Email Submission Operations: Access and Accountability Requirements[END_REF].

As OLSRv2 is often used in wireless environments, it is potentially exposed to different kinds of security threats, some of which are of greater significance when compared to wired networks. As radio signals can be received as well as transmitted by any compatible wireless device within radio range, there are commonly no physical constraints on the conformation of nodes and communication links that make up the network (as could be expected for wired networks).

A first step towards hardening against attacks disrupting the connectivity of a network is to understand the vulnerabilities of the routing protocol managing the connectivity. Therefore, this document analyzes OLSRv2 in order to understand its inherent vulnerabilities and resilience. The authors do not claim completeness of the analysis but hope that the identified attacks, as presented, form a meaningful starting point for developing and deploying increasingly well-secured OLSRv2 networks.

This document describes security vulnerabilities of OLSRv2 when it is used without the mandatory-to-implement security mechanisms, as specified in Section 23.5 of [START_REF] Clausen | The Optimized Link State Routing Protocol Version 2[END_REF]. It also analyzes which of these security vulnerabilities can be mitigated when using the mandatory-to-implement security mechanisms for OLSRv2 and how the As NHDP is a fundamental component of OLSRv2, the vulnerabilities of NHDP, discussed in [START_REF] Yi | Security Threats for the Neighborhood Discovery Protocol (NHDP)[END_REF], also apply to OLSRv2.

It should be noted that many OLSRv2 implementations are configurable, and so an attack on the configuration system (such as [START_REF] Herberg | Definition of Managed Objects for the Neighborhood Discovery Protocol[END_REF] and [START_REF] Herberg | Definition of Managed Objects for the Optimized Link State Routing Protocol Version 2[END_REF]) can be used to adversely affect the operation of an OLSRv2 implementation.

OLSRv2 Overview

OLSRv2 contains three basic processes: neighborhood discovery, Multipoint Relay (MPR) selection, and Link State Advertisements (LSAs). They are described in the sections below with sufficient details to allow elaboration of the analyses in this document.

Neighborhood Discovery

Neighborhood discovery is the process whereby each router discovers the routers that are in direct communication range of itself (1-hop neighbors) and detects with which of these it can establish bidirectional communication. Each router sends HELLO messages periodically, listing the identifiers of all the routers from which it has recently received a HELLO message as well as the "status" of the link (heard or verified bidirectional). A router A receiving a HELLO message from a neighbor router B, in which B indicates it has recently received a HELLO message from A, considers the link A-B to be bidirectional. As B lists identifiers of all its neighbors in its HELLO message, A learns the "neighbors of its neighbors" (2-hop neighbors) through this process. HELLO messages are sent periodically; however, certain events may trigger non-periodic HELLOs. OLSRv2 [START_REF] Clausen | The Optimized Link State Routing Protocol Version 2[END_REF] uses NHDP [START_REF] Clausen | Mobile Ad Hoc Network (MANET) Neighborhood Discovery Protocol (NHDP)[END_REF] as its neighborhood discovery mechanism. The vulnerabilities of NHDP are analyzed in [START_REF] Yi | Security Threats for the Neighborhood Discovery Protocol (NHDP)[END_REF]. In their HELLO messages, routers may express their "willingness" to be selected as an MPR using an integer between 0 and 7 ("will never" to "will always"). This is taken into consideration for the MPR calculation and is useful, for example, when an OLSRv2 network is "planned". The set of routers having selected a given router as an MPR is the MPR

Terminology

This document uses the terminology and notation defined in [START_REF] Clausen | Generalized Mobile Ad Hoc Network (MANET) Packet/Message Format[END_REF], [START_REF] Clausen | Mobile Ad Hoc Network (MANET) Neighborhood Discovery Protocol (NHDP)[END_REF], and [START_REF] Clausen | The Optimized Link State Routing Protocol Version 2[END_REF]. Additionally, it defines the following terminology:

Compromised OLSRv2 router: An attacker that eavesdrops on the network traffic and/or generates syntactically correct OLSRv2 control messages. Control messages emitted by a compromised OLSRv2 router may contain additional information or omit information, as compared to a control message generated by a noncompromised OLSRv2 router located in the same topological position in the network.

Legitimate OLSRv2 router: An OLSRv2 router that is not a compromised OLSRv2 router.

Topology Map Acquisition

Topology Map Acquisition relates to the ability for any given router in the network to acquire a representation of the network connectivity. A router that is unable to acquire a topology map is incapable of calculating routing paths and participating in forwarding data. Topology map acquisition can be hindered by (i) TCs The jamming and flooding disruption due to identity spoofing and link spoofing have been discussed in [START_REF] Yi | Security Threats for the Neighborhood Discovery Protocol (NHDP)[END_REF].

Attack on Jittering

OLSRv2 incorporates a jittering mechanism: a random, but bounded, delay on outgoing control traffic [START_REF] Clausen | Jitter Considerations in Mobile Ad Hoc Networks (MANETs)[END_REF]. This may be necessary when link layers (such as 802.11 [IEEE802.11]) are used that do not guarantee collision-free delivery of frames and where jitter can reduce the probability of collisions of frames on lower layers.

In OLSRv2, TC forwarding is jittered by a value between 0 and MAX_JITTER. In order to reduce the number of transmissions, when a control message is due for transmission, OLSRv2 piggybacks all queued messages into a single transmission. Thus, if a compromised OLSRv2 router sends many TCs within a very short time interval, the jitter time of the attacked router tends towards 0. This renders jittering ineffective and can lead to collisions on the link layer.

In addition to causing more collisions, forwarding a TC with little or no jittering can make sure that the TC message forwarded by a compromised router arrives before the message forwarded by legitimate routers. The compromised router can thus inject malicious content in the TC: for example, if the message identification is spoofed, the legitimate message will be discarded as a duplicate message. This preemptive action is important for some of the attacks introduced in the following sections.

Hop Count and Hop Limit Attacks

The hop count and hop limit fields are the only parts of a TC that are modified when forwarding; therefore, they are not protected by integrity check mechanisms. A compromised OLSRv2 router can modify either of these when forwarding TCs.

Modifying the Hop Limit

A compromised OLSRv2 router can decrease the hop limit when forwarding a TC. This will reduce the scope of forwarding for the message and may lead to some routers in the network not receiving that TC. Note that this is not necessarily the same as not relaying the message (i.e., setting the hop limit to 0), as is illustrated in Figure 1.

Clausen, et al.

Informational [Page 8] May 2017 .---. | X | --'---' __ / \ / \ .---. .---. TC -----> | A | | C | '---' '---' \ .---. / \--| B |__/ '---'
Figure 1: Hop Limit Attack

A TC arrives at and is forwarded by router A such that it is received by both B and the malicious X. X can forward the TC without any delay (including without jitter) such that its transmissions arrive before that of B at C. Before forwarding, it significantly reduces the hop limit of the message. Router C receives the TC, processes (and forwards) it, and marks it as already received --causing it to discard further copies received from B. Thus, if the TC is forwarded by C, it has a very low hop limit and will not reach the whole network.

Modifying the Hop Count

A compromised OLSRv2 router can modify the hop count when forwarding a TC. This may have two consequences: (i) if the hop count is set to the maximum value, then the TC will be forwarded no further or (ii) artificially manipulating the hop count may affect the validity time as calculated by recipients, when using distance-dependent validity times as defined in [START_REF] Clausen | Representing Multi-Value Time in Mobile Ad Hoc Networks (MANETs)[END_REF] (e.g., as part of a Fish Eye extension to OLSR2 [OLSR-FSR] [OLSR-FSR-Scaling]).

v_time(3hops)=9s v_time(4hops)=12s v_time(5hops)=15s .---.

. A are sent less frequently than that up to 4 hops, this causes links advertised in such TCs to be only intermittently available to C.

---. .---. .---. | A |--... --> | B | -------> | X |---------->| C | '---' '---' '---' '---'

Effective Topology

Link state protocols assume that each router can acquire an accurate topology map that reflects the effective network topology. This implies that the routing protocol is able to identify a path from a source to a destination, and this path is valid for forwarding data traffic. If an attacker disturbs the correct protocol behavior, the perceived topology map of a router can permanently differ from the effective topology.

Consider the example in Figure 3(a), which illustrates the topology map as acquired by router S. This topology map indicates that the routing protocol has identified that for S, a path exists to D via B, which it therefore assumes can be used for transmitting data. If B does not forward data traffic from S, then the topology map in S does not accurately reflect the effective network topology. Rather, the effective network topology from the point of view of S would be as indicated in Figure 3(b): D is not part of the network reachable from router S.

.

---. .---. .---. .---. .---. | S |----| B |----| D | | S |----| B | '---' '---' '---' '---' '---' (a) (b)
Figure 3: Incorrect Data Traffic Forwarding Some of the attacks related to NHDP, such as message timing attacks and indirect channel overloading, are discussed in [START_REF] Yi | Security Threats for the Neighborhood Discovery Protocol (NHDP)[END_REF]. Other threats specific to OLSRv2 are further detailed in this section.

Incorrect Forwarding

OLSRv2 routers exchange information using link-local transmissions (link-local multicast or limited broadcast) for their control messages, with the routing process in each router retransmitting received messages destined for network-wide diffusion. Thus, if the operating system in a router is not configured to enable forwarding, this will not affect the operating of the routing protocol or the topology map acquired by the routing protocol. It will, however, cause a discrepancy between the effective topology and the topology map, as indicated in Figures 3(a This situation is not hypothetical. A common error seen when deploying OLSRv2-based networks using a Linux-based computer as a router is to neglect enabling IP forwarding, which effectively becomes an accidental attack of this type.

Wormholes

A wormhole, depicted in the example in Figure 4, may be established between two collaborating devices that are connected by an out-ofband channel. These devices send traffic through the "tunnel" to their alter ego, which "replays" the traffic. Thus, routers D and S appear as if direct neighbors and are reachable from each other in 1 hop through the tunnel, with the path through the MANET being 100 hops long.

. The consequences of such a wormhole in the network depend on the detailed behavior of the wormhole. If the wormhole relays only control traffic, but not data traffic, the same considerations as in Section 4.1 apply. If, however, the wormhole relays all traffic (control and data alike), it is identical, connectivity wise, to a usable link -and the routing protocol will correctly generate a topology map reflecting the effective network topology. The efficiency of the topology obtained depends on (i) the wormhole characteristics, (ii) how the wormhole presents itself, and (iii) how paths are calculated.

Assuming that paths are calculated with unit cost for all links, including the "link" presented by the wormhole, if the real characteristics of the wormhole are as if it were a path of more than 100 hops (e.g., with respect to delay, bandwidth, etc.), then the presence of the wormhole results in a degradation in performance as compared to using the non-wormhole path. Conversely, if the "link" presented by the wormhole has better characteristics, the wormhole results in improved performance.

Clausen, et al.

Informational [Page 11] May 2017

If paths are calculated using non-unit-costs for all links, and if the cost of the "link" presented by the wormhole correctly represents the actual cost (e.g., if the cost is established through measurements across the wormhole), then the wormhole may, in the worst case, cause no degradation in performance or, in the best case, improve performance by offering a better path. If the cost of the "link" presented by the wormhole is misrepresented, then the same considerations as for unit-cost links apply.

An additional consideration with regard to wormholes is that they may present topologically attractive paths for the network; however, it may be undesirable to have data traffic transit such a path. An attacker could, by virtue of introducing a wormhole, acquire the ability to record and inspect transiting data traffic.

Sequence Number Attacks

OLSRv2 uses two different sequence numbers in TCs to (i) avoid processing and forwarding the same message more than once (Message Sequence Number) and to (ii) ensure that old information, arriving late due to, e.g., long paths or other delays, is not allowed to overwrite more recent information generated (Advertised Neighbor Sequence Number (ANSN)).

Message Sequence Number

An attack may consist of a compromised OLSRv2 router spoofing the identity of another router in the network and transmitting a large number of TCs, each with different Message Sequence Numbers. Subsequent TCs with the same sequence numbers, originating from the router whose identity was spoofed, would hence be ignored until eventually information concerning these "spoofed" TCs expires.

Advertised Neighbor Sequence Number (ANSN)

An attack may consist of a compromised OLSRv2 router spoofing the identity of another router in the network and transmitting a single TC with an ANSN significantly larger than that which was last used by the legitimate router. Routers will retain this larger ANSN as "the most recent information" and discard subsequent TCs with lower sequence numbers as being "old".

Clausen, et al.

Informational [Page 12]

RFC 8116

OLSRv2 Threats May 2017

Indirect Jamming

Indirect jamming is an attack in which a compromised OLSRv2 router is, by its actions, causing legitimate routers to generate inordinate amounts of control traffic, thereby increasing both channel occupation and the overhead incurred in each router for processing this control traffic. This control traffic will be originated from legitimate routers; thus, to the wider network, the malicious device may remain undetected.

The general mechanism whereby a malicious router can cause indirect jamming is for it to participate in the protocol by generating plausible control traffic and to tune this control traffic to in turn trigger receiving routers to generate additional traffic. For OLSRv2, such an indirect attack can be directed at the neighborhood discovery mechanism and the LSA mechanism, respectively.

One efficient indirect jamming attack in OLSRv2 is to target control traffic destined for network-wide diffusion. This is illustrated in Figure 5.

The malicious router X selects router A as an MPR at time t0 in a HELLO. This causes X to appear as MPR selector for A and, consequently, A sets X to be advertised in its "Neighbor Set" and increments the associated "Advertised Neighbor Sequence Number" (ANSN). Router A must then advertise the link between itself and X in subsequent outgoing TCs (t1), also including the ANSN in such TCs. Upon X having received this TC, it declares the link between itself and A as no longer valid (t2) in a HELLO (indicating the link to A as LOST). Since only symmetric links are advertised by OLSRv2 routers, A will (upon receipt hereof) remove X from the set of advertised neighbors and increment the ANSN. Router A will then, in subsequent TCs, advertise the remaining set of advertised neighbors (i.e., with X removed) and the corresponding ANSN (t3). Upon X having received this information in another TC from A, it may repeat this cycle, alternating advertising the link A-X as "LOST" and as "MPR".

Clausen, et al.

Informational [Page 13] May 2017

This attack can cause the TC interval to permanently become equal to the minimum message interval. [START_REF] Clausen | The Optimized Link State Routing Protocol Version 2[END_REF] proposes as default that the minimum TC interval be 0.25 x TC_INTERVAL (TC_INTERVAL being the maximum interval between two TC messages from the same OLSRv2 router).

Indirect jamming by a compromised OLSRv2 router can thus have two effects: (i) it may cause increased frequency of TC generation and transmission, and (ii) it will cause additional routing table recalculation in all routers in the network.

Inconsistent Topology

Inconsistent topology maps can occur by a compromised OLSRv2 router employing either identity spoofing or link spoofing for conducting an attack against an OLSRv2 network. The threats related to NHDP, such as identity spoofing in NHDP, link spoofing in NHDP, and creating loops, have been illustrated in [START_REF] Yi | Security Threats for the Neighborhood Discovery Protocol (NHDP)[END_REF]. This section mainly addresses the vulnerabilities in [START_REF] Clausen | The Optimized Link State Routing Protocol Version 2[END_REF].

Identity Spoofing

Identity spoofing can be employed by a compromised OLSRv2 router via the neighborhood discovery process and via the LSA process. Either of them causes inconsistent topology maps in routers in the network. The creation of inconsistent topology maps due to neighborhood discovery has been discussed in [START_REF] Yi | Security Threats for the Neighborhood Discovery Protocol (NHDP)[END_REF]. For OLSRv2, the attack on the LSA process can also cause inconsistent topology maps.

An inconsistent topology map may occur when the compromised OLSRv2 router takes part in the LSA process by selecting a neighbor as an MPR, which in turn advertises the spoofed identities of the compromised OLSRv2 router. This attack will alter the topology maps of all routers of the network.

A --B --C --D --E --F --X (X spoofs A)

Description: A compromised OLSRv2 router X spoofs the identity of A, leading to a wrongly perceived topology. selects B as an MPR, the link B-A will also be advertised in the network.

When calculating paths, B and C will calculate paths to A via B, as illustrated in Figure 7(a); for these routers, the shortest path to A is via B. E and F will calculate paths to A via F, as illustrated in Figure 7(b); for these routers, the shortest path to A is via the compromised OLSRv2 router X, and these are thus disconnected from the real A. D will have a choice, as the path calculated to A via B is of the same length as the path via the compromised OLSRv2 router X, as illustrated in Figure 7(c).

In general, the following observations can be made:

o The network will be split in two, with those routers closer to B than to X reaching A, whereas those routers closer to X than to B will be unable to reach A.

o Routers beyond B, i.e., routers beyond 1 hop away from A, will be unable to detect this identity spoofing.

The identity spoofing attack via the LSA procedure has a higher impact than the attack on the neighborhood discovery procedure since it alters the topology maps of all routers in the network and not only in the 2-hop neighborhood. However, the attack is easier to detect by other routers in the network. Since the compromised OLSRv2 router is advertised in the whole network, routers whose identities are spoofed by the compromised OLSRv2 router can detect the attack. For example, when A receives a TC from F advertising the link F-A, it can deduce that some entity is injecting incorrect link state information as it does not have F as one of its direct neighbors.

(X spoofs A)

A < ----B < ----C E ----> F ----> X (a) Routers B and C (b) Routers E and F A < ---B < ---C < ---D ---> E ---> F ----> X (X spoofs A)
Description: These paths appear as calculated by the different routers in the network in presence of a compromised OLSRv2 router X, spoofing the address of A. As the compromised OLSRv2 router X does not itself send the TCs, but rather, by virtue of MPR selection, ensures that the addresses it spoofs are advertised in TCs from its MPR selector F, the attack may be difficult to counter. Simply ignoring TCs that originate from F may also suppress the link state information for other, legitimate, MPR selectors of F.

Thus, identity spoofing by a compromised OLSRv2 router, participating in the LSA process by selecting MPRs only, creates a situation wherein two or more routers have substantially inconsistent topology maps: traffic for an identified destination is, depending on where in the network it appears, delivered to different routers.

Link Spoofing

Link spoofing is a situation in which a router advertises nonexisting links to another router (possibly not present in the network). Essentially, TCs and HELLOs both advertise links to direct neighbor routers with the difference being the scope of the advertisement. Thus, link spoofing consists of a compromised OLSRv2 router reporting that it has neighbors routers that are either not present in the network or are effectively not neighbors of the compromised OLSRv2 router.

It can be noted that a situation similar to link spoofing may occur temporarily in an OLSR or OLSRv2 network without compromised OLSRv2 routers: if A was, but is no more, a neighbor of B, then A may still be advertising a link to B for the duration of the time it takes for the neighborhood discovery process to determine this changed neighborhood.

In the context of this document, link spoofing refers to a persistent situation where a compromised OLSRv2 router intentionally advertises links to other routers for which it is not a direct neighbor. 8 illustrates a network in which the compromised OLSRv2 router X spoofs links to an existing router A by participating in the LSA process and including this non-existing link in its advertisements.

A ---B ---C ---D ---E ---F ---G ---H ---X (X spoofs the link to A) Description: The compromised OLSRv2 router X advertises a spoofed link to A in its TCs; thus, all routers will record both of the links X-A and B-A.

Figure 8: Link Spoofing

As TCs are flooded through the network, all routers will receive and record information describing a link X-A in this link state information. If A has selected router B as an MPR, B will likewise flood this link state information through the network; thus, all routers will receive and record information describing a link B-A.

When calculating routing paths, B, C, and D will calculate paths to A via B, as illustrated in Figure 9(a); for these routers, the shortest path to A is via B. F and G will calculate paths to A via X, as illustrated in Figure 9(b); for these routers, the shortest path to A is via X, and these are thus disconnected from the real router A. E will have a choice: the path calculated to A via B is of the same length as the path via X, as illustrated in Figure 9 In general, the following observations can be made:

o The network will be separated in two: routers closer to B than X will reach A, whereas routers closer to X than B will be unable to reach A. o Routers beyond B, i.e., routers beyond 1 hop away from A, will be unable to detect this link spoofing.

Mitigation of Security Vulnerabilities for OLSRv2

As described in Section 1, [START_REF] Herberg | Integrity Protection for the Neighborhood Discovery Protocol (NHDP) and Optimized Link State Routing Protocol Version 2 (OLSRv2)[END_REF] specifies a security mechanism for OLSRv2 that is mandatory to implement. However, deployments may choose to use different security mechanisms if more appropriate. Therefore, it is important to understand both the inherent resilience of OLSRv2 against security vulnerabilities when not using the mechanisms specified in [START_REF] Herberg | Integrity Protection for the Neighborhood Discovery Protocol (NHDP) and Optimized Link State Routing Protocol Version 2 (OLSRv2)[END_REF] and the protection that [START_REF] Herberg | Integrity Protection for the Neighborhood Discovery Protocol (NHDP) and Optimized Link State Routing Protocol Version 2 (OLSRv2)[END_REF] provides when used in a deployment.

Inherent OLSRv2 Resilience

OLSRv2 (even when used without the mandatory-to-implement security mechanisms in [START_REF] Herberg | Integrity Protection for the Neighborhood Discovery Protocol (NHDP) and Optimized Link State Routing Protocol Version 2 (OLSRv2)[END_REF]) provides some inherent resilience against part of the attacks described in this document. In particular, it provides the following resilience:

o Sequence numbers: OLSRv2 employs message sequence numbers, which are specific per the router identity and message type. Routers keep an "information freshness" number (ANSN) incremented each time the content of an LSA from a router changes. This allows rejecting both "old" information and duplicate messages, and it provides some protection against "message replay". However, this also presents an attack vector (Section 4.3).

o Ignoring unidirectional links: The neighborhood discovery process detects and admits only bidirectional links for use in MPR selection and LSA. Jamming attacks may affect only reception of control traffic; however, OLSRv2 will correctly recognize, and ignore, such a link that is not bidirectional.

o Message interval bounds: The frequency of control messages, with minimum intervals imposed for HELLO and TCs. This may limit the impact from an indirect jamming attack (Section 4.4). shared key between all routers in the MANET is assumed. A router without valid credentials is not able to create an ICV that can be correctly verified by other routers in the MANET; therefore, such an incorrectly signed message will be rejected by other MANET routers, and the router cannot participate in the OLSRv2 routing process (i.e., the malicious router will be ignored by other legitimate routers). [START_REF] Herberg | Integrity Protection for the Neighborhood Discovery Protocol (NHDP) and Optimized Link State Routing Protocol Version 2 (OLSRv2)[END_REF] does not address the case where a router with valid credentials has been compromised. Such a compromised router will not be excluded from the routing process, and other means of detecting such a router are necessary if required in a deployment: for example, using an asymmetric key extension to [START_REF] Herberg | Integrity Check Value and Timestamp TLV Definitions for Mobile Ad Hoc Networks (MANETs)[END_REF] that allows revocation of the access of one particular router.

In the following sections, each of the vulnerabilities described earlier in this document will be evaluated in terms of whether OLSRv2 with the mechanisms in [START_REF] Herberg | Integrity Protection for the Neighborhood Discovery Protocol (NHDP) and Optimized Link State Routing Protocol Version 2 (OLSRv2)[END_REF] provides sufficient protection against the attack. It is implicitly assumed in each of the following sections that [RFC7183] is used with OLSRv2. Attack on Jittering: As only OLSRv2 routers with valid credentials can participate in the routing process, a malicious router cannot reduce the jitter time of an attacked router to 0 by sending many TC messages in a short time. The attacked router would reject all the incoming messages as "invalid" and not forward them. The same applies for the case where a malicious router wants to assure that by forcing a 0 jitter interval, the message arrives before the same message forwarded by legitimate routers.

Modifying the Hop Limit and the Hop Count: As the hop limit and hop count are not protected by [START_REF] Herberg | Integrity Protection for the Neighborhood Discovery Protocol (NHDP) and Optimized Link State Routing Protocol Version 2 (OLSRv2)[END_REF] (since they are mutable fields that change at every hop), this attack is still feasible. It is possible to apply [START_REF] Clausen | Generalized Mobile Ad Hoc Network (MANET) Packet/Message Format[END_REF] packet-level protection by using ICV Packet TLV defined in [START_REF] Herberg | Integrity Check Value and Timestamp TLV Definitions for Mobile Ad Hoc Networks (MANETs)[END_REF] to provide hop-by-hop integrity protection --at the expense of a requirement of pairwise trust between all neighbor routers.

Effective Topology

Incorrect Forwarding: As only OLSRv2 routers with valid credentials can participate in the routing process, a malicious router will not be part of the topology of other legitimate OLSRv2 routers. Therefore, no data traffic will be sent to the malicious router for forwarding.

Wormholes: Since a wormhole consists of at least two devices forwarding (unmodified) traffic, this attack is still feasible and undetectable by the OLSRv2 routing process since the attack does not involve the OLSRv2 protocol itself (but rather lower layers). By using [START_REF] Herberg | Integrity Protection for the Neighborhood Discovery Protocol (NHDP) and Optimized Link State Routing Protocol Version 2 (OLSRv2)[END_REF], it can at least be assured that the content of the control messages is not modified while being forwarded via the wormhole. Moreover, the timestamp TLV assures that the forwarding can only be done in a short time window after the actual TC message has been sent.

Message Sequence Number: As the message sequence number is included in the ICV calculation, OLSRv2 is protected against this attack.

Advertised Neighbor Sequence Number (ANSN): As the ANSN is included in the ICV calculation, OLSRv2 is protected against this attack.

Indirect Jamming: Since the control messages of a malicious router will be rejected by other legitimate OLSRv2 routers in the MANET, this attack is mitigated. Identity Spoofing: Since the control messages of a malicious router will be rejected by other legitimate OLSRv2 routers in the MANET, a router without valid credentials may spoof its identity (e.g., IP source address or message originator address), but the messages will be ignored by other routers. As the mandatory mechanism in [START_REF] Herberg | Integrity Protection for the Neighborhood Discovery Protocol (NHDP) and Optimized Link State Routing Protocol Version 2 (OLSRv2)[END_REF] uses shared keys amongst all MANET routers, a single compromised router may spoof its identity and cause harm to the network stability. Removing this one malicious router, once detected, implies rekeying all other routers in the MANET. Asymmetric keys, particularly when using identity-based signatures (such as those specified in [START_REF] Dearlove | Identity-Based Signatures for Mobile Ad Hoc Network (MANET) Routing Protocols[END_REF]), may give the possibility of revoking single routers and verifying their identity based on the ICV itself.

Link Spoofing: Similar to identity spoofing, a malicious router without valid credentials may spoof links, but its control messages will be rejected by other routers, thereby mitigating the attack.

Inconsistent Topology Maps Due to LSAs: The same considerations for link spoofing apply.

Correct Deployment

Other than implementing OLSRv2, including appropriate security mechanisms, the way in which the protocol is deployed is also important to ensure proper functioning and threat mitigation. For example, Section 4.1 discussed considerations due to an incorrect forwarding-policy setting, and Section 4.2 discussed considerations for when intentional wormholes are present in a deployment.

Security Considerations

This document does not specify a protocol or a procedure but reflects on security considerations for OLSRv2 and for its constituent parts, including NHDP. The document initially analyses threats to topology map acquisition, with the assumption that no security mechanism (including the mandatory-to-implement mechanisms from [START_REF] Herberg | Integrity Check Value and Timestamp TLV Definitions for Mobile Ad Hoc Networks (MANETs)[END_REF] and [START_REF] Herberg | Integrity Protection for the Neighborhood Discovery Protocol (NHDP) and Optimized Link State Routing Protocol Version 2 (OLSRv2)[END_REF]) is in use. Then, it proceeds to discuss how the use of [START_REF] Herberg | Integrity Check Value and Timestamp TLV Definitions for Mobile Ad Hoc Networks (MANETs)[END_REF] and [START_REF] Herberg | Integrity Protection for the Neighborhood Discovery Protocol (NHDP) and Optimized Link State Routing Protocol Version 2 (OLSRv2)[END_REF] mitigate the identified threats. When [START_REF] Herberg | Integrity Protection for the Neighborhood Discovery Protocol (NHDP) and Optimized Link State Routing Protocol Version 2 (OLSRv2)[END_REF] is used with routers using a single shared key, the protection offered is not effective if a compromised router has valid credentials.

Clausen

  to (all) routers in the network, such as what happens in case of flooding disruption, or (ii) in case of "jamming" of the communication channel.

Figure 2 :

 2 Figure 2: Different Validity Times Based on the Distance in HopsIn Figure2, router A sends a TC with a validity time of 9 seconds for routers in a 3-hop distance, 12 seconds for routers in a 4-hop distance, and 15 seconds in a 5-hop distance. If X is a compromised OLSRv2 router and modifies the hop count (say, by decreasing it to 3), then C will calculate the validity time of received information to 9 seconds --after which it expires unless refreshed. If TCs from

Figure 4 :

 4 Figure 4: Wormholing between Two Collaborating Devices Not Participating in the Routing Protocol

Figure 6 :

 6 Figure 6: Identity SpoofingIn Figure6, router X spoofs the address of router A. If X selects F as an MPR, all routers in the network will be informed about the link F-A by the TCs originating from F. Assuming that (the real) A

Figure

  Figure 7: Routing Paths towards A

  (b). A < ---B < ---C < ---D F ---> G ---> X ---> A (a) Routers B, C, and D (b) Routers F and G A < ---B < ---C < ---D < ---E ---> F ---> G ---> X ---> A (c) Router E Description: These paths appear as calculated by the different routers in the network in the presence of a compromised OLSRv2 router X, spoofing a link to router A.

Figure

  Figure 9: Routing Paths towards Router A

  1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 1.1. OLSRv2 Overview . . . . . . . . . . . . . . . . . . . . . 1.1.1. Neighborhood Discovery . . . . . . . . . . . . . . . 1.1.2. MPR Selection . . . . . . . . . . . . . . . . . . . . 1.1.3. Link State Advertisement . . . . . . . . . . . . . . 1.2. Link State Vulnerability Taxonomy . . . . . . . . . . . . 1.3. OLSRv2 Attack Vectors . . . . . . . . . . . . . . . . . . 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3. Topology Map Acquisition . . . . . . . . . . . . . . . . . . 3.1. Attack on Jittering . . . . . . . . . . . . . . . . . . . 3.2. Hop Count and Hop Limit Attacks . . . . . . . . . . . . . 3.2.1. Modifying the Hop Limit . . . . . . . . . . . . . . . 3.2.2. Modifying the Hop Count . . . . . . . . . . . . . . . 4. Effective Topology . . . . . . . . . . . . . . . . . . . . . 4.1. Incorrect Forwarding . . . . . . . . . . . . . . . . . . 4.2. Wormholes . . . . . . . . . . . . . . . . . . . . . . . . 4.3. Sequence Number Attacks . . . . . . . . . . . . . . . . . 4.3.1. Message Sequence Number . . . . . . . . . . . . . . . 4.3.2. Advertised Neighbor Sequence Number (ANSN) . . . . . 4.4. Indirect Jamming . . . . . . . . . . . . . . . . . . . . 5. Inconsistent Topology . . . . . . . . . . . . . . . . . . . . .3. Correct Deployment . . . . . . . . . . . . . . . . . . . 7. Security Considerations . . . . . . . . . . . . . . . . . . . 8. References . . . . . . . . . . . . . . . . . . . . . . . . . Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . .

	1. Introduction
	Clausen, et al.	Informational	[Page 3]

5.1. Identity Spoofing . . . . . . . . . . . . . . . . . . . . 5.2. Link Spoofing . . . . . . . . . . . . . . . . . . . . . . 5.2.1. Inconsistent Topology Maps Due to Link State Advertisements . . . . . . . . . . . . . . . . . . . 6. Mitigation of Security Vulnerabilities for OLSRv2 . . . . . . 6.1. Inherent OLSRv2 Resilience . . . . . . . . . . . . . . . 6.2. Resilience by Using RFC 7183 with OLSRv2 . . . . . . . . 6.2.1. Topology Map Acquisition . . . . . . . . . . . . . . 6.2.2. Effective Topology . . . . . . . . . . . . . . . . . 6.2.3. Inconsistent Topology . . . . . . . . . . . . . . . . 68.1. Normative References . . . . . . . . . . . . . . . . . . 8.2. Informative References . . . . . . . . . . . . . . . . .

  to other routers (pretend existence of links to other routers), henceforth called link spoofing. Such attacks may disrupt the LSA process by targeting the MPR flooding mechanism or by causing incorrect link state information to be included in TCs, causing routers to have incomplete, inaccurate, or inconsistent topology maps. In a different class of attacks, a compromised OLSRv2 router injects control traffic designed so as to cause an in-router resource exhaustion, e.g., by causing the algorithms calculating routing tables or MPR sets to be invoked continuously, preventing the internal state of a router from converging, which depletes the energy of battery-driven routers, etc.

			May 2017
	topology map that does not reflect the effective network topology,
	and (c) two or more routers may acquire inconsistent topology maps.
	1.3. OLSRv2 Attack Vectors
	Besides "radio jamming", attacks on OLSRv2 consist of a compromised
	OLSRv2 router injecting apparently correct, but invalid, control
	traffic (TCs, HELLOs) into the network. A compromised OLSRv2 router
	can either (a) advertise erroneous information about itself (its
	identification and its willingness to serve as an MPR), henceforth
	called identity spoofing, or (b) advertise erroneous information
	about its relationship
	selector set of that router. A study of the MPR
	flooding algorithm can be found in [MPR-FLOODING].
	1.1.3. Link State Advertisement
	Link State Advertisement (LSA) is the process whereby routers
	determine which link state information to advertise through the
	network. Each router must advertise, at least, all links between
	itself and its MPR selectors in order to allow all routers to
	calculate shortest paths. Such LSAs are carried in Topology Control
	(TC) messages, which are broadcast through the network using the MPR
	flooding process described in Section 1.1.2. As a router selects
	MPRs only from among bidirectional neighbors, links advertised in TC
	are also bidirectional and routing paths calculated by OLSRv2 contain
	only bidirectional links. TCs are sent periodically; however,
	certain events may trigger non-periodic TCs.
	1.2. Link State Vulnerability Taxonomy
	Proper functioning of OLSRv2 assumes that:
	o each router signals its presence in the network and the topology
	information that it obtained correctly;
	o each router can acquire and maintain a topology map that
	accurately reflects the effective network topology; and,
	o that the network converges, i.e., that all routers in the network
	will have sufficiently identical topology maps.
	An OLSRv2 network can be disrupted by breaking any of these
	assumptions, specifically that (a) routers may be prevented from
	acquiring a topology map of the network, (b) routers may acquire a
	Clausen, et al.	Informational	[Page 6]

  In addition, a timestamp TLV is added to the message prior to creating the ICV, enabling replay protection of messages. The document specifies how to sign outgoing messages and how to verify incoming messages, as well as under which circumstances an invalid message is rejected. Because of the HMAC/SHA-256 ICV, a

			May 2017
	o Additional reasons for rejecting control messages: The OLSRv2
	specification includes a list of reasons for which an incoming
	control message should be rejected as malformed --and allows that
	a protocol extension may recognize additional reasons for OLSRv2
	to consider a message malformed. Together with the flexible
	message format [RFC5444], this allows addition of security
	mechanisms, such as digital signatures, while remaining compliant
	with the OLSRv2 standard specification.
	6.2. Resilience by Using RFC 7183 with OLSRv2
	[RFC7183] specifies mechanisms for integrity and replay protection
	for NHDP and OLSRv2 using the generalized packet/message format
	described in [RFC5444] and the TLV definitions in [RFC7182]. The
	specification describes how to add an Integrity Check Value (ICV) in
	a TLV to each control message, providing integrity protection of the
	content of the message using Hashed Message Authentication Code
	(HMAC) / SHA-256.
	Clausen, et al.	Informational	[Page 19]

.---.

.---.

.

---. | A | | A | | A | | A | '---'

'---' '---' '---'

Description: The malicious X flips between link status MPR and LOST.

Figure 5: Indirect Jamming in Link State Advertisement Routers receiving a TC message will parse and process this message, specifically updating their topology map as a consequence of successful receipt. If the ANSN between two successive TCs from the same router has incremented, then the topology has changed and routing sets are to be recalculated. This has the potential to be a computationally costly operation.

A compromised OLSRv2 router may chose to conduct this attack against all its neighbors, thus maximizing its disruptive impact on the network with relatively little overhead of its own: other than participating in the neighborhood discovery procedure, the compromised OLSRv2 router will monitor TCs generated by its neighbors and alternate the advertised status for each such neighbor between "MPR" and "LOST". The compromised OLSRv2 router will indicate its willingness to be selected as an MPR as 0 (thus avoiding selection as an MPR) and may ignore all other protocol operations while still remaining effective as an attacker.

The basic operation of OLSRv2 employs periodic message emissions, and by this attack it can be ensured that each such periodic message will entail routing table recalculation in all routers in the network.

If the routers in the network have "triggered TCs" enabled, this attack may also cause an increased TC frequency. Triggered TCs are intended to allow a (stable) network to have relatively low TC emission frequencies yet still allow link breakage or link emergence to be advertised through the network rapidly. A minimum message interval (typically much smaller than the regular periodic message interval) is imposed to rate-limit worst-case message emissions.


Guillaume Losfeld

Jean-Baptiste Saunier

Claude Grison
email: claude.grison@cefe.cnrs.fr

Minor and trace

Keywords:

come

Introduction

With regards to TE in honey and apiary products, various studies have been undertaken with different aims. Some focus on the use of TE to certify geographical origins [START_REF] Hernandez | Characterization of honey from the Canary Islands: Determination of the mineral content by atomic absorption spectrophotometry[END_REF][START_REF] Terrab | Mineral content and electrical conductivity of the honeys produced in Northwest Morocco and their contribution to the characterisation of unifloral honeys[END_REF][START_REF] Terrab | Contribution to the study of avocado honeys by their mineral contents using inductively coupled plasma optical emission spectrometry[END_REF] or to assess quality [START_REF] Devillers | Chemometrical analysis of 18 metallic and nonmetallic elements found in honeys sold in France[END_REF][START_REF] Pisani | Minor and trace elements in different honey types produced in Siena County (Italy)[END_REF]. The use of apiary products for TE biomonitoring has also been extensively investigated [START_REF] Bilandzic | Determination of trace elements in Croatian floral honey originating from different regions[END_REF][START_REF] Lambert | Bees, honey and pollen as sentinels for lead environmental contamination[END_REF][START_REF] Tuzen | Trace element levels in honeys from different regions of Turkey[END_REF] and reviewed [START_REF] Bogdanov | Contaminants of bee products[END_REF][START_REF] Pohl | Determination and Fractionation of Metals in Honey[END_REF].

Contradictory conclusions were found with regards to the use of apiary products for TE environmental monitoring. [START_REF] Tuzen | Trace element levels in honeys from different regions of Turkey[END_REF] suggested the use of honey, while according to [START_REF] Bogdanov | Minerals in honey: environmental geographical and botanical aspects[END_REF], low TE concentrations and high natural variations should deter from using honey. In the case of Pb recent studies also showed that honey was the least affected matrix from beehives, but could nonetheless be used for environmental monitoring [START_REF] Lambert | Bees, honey and pollen as sentinels for lead environmental contamination[END_REF][START_REF] Mihaly Cozmuta | Lead traceability along soil-melliferous flora-bee family-apiary products chain[END_REF]. In spite of abundant data from the literature, reference levels for noxious TE in honey are difficult to find [START_REF] Devillers | Chemometrical analysis of 18 metallic and nonmetallic elements found in honeys sold in France[END_REF], and additional data on the potential impacts of a heavily contaminated environ-ment on honey could improve insights and provide additional material to assess the potential risks. The present investigation of the TE content of apiary products from a historical Zn-Pb mining district (Les Malines, southern France) aims to address these topics.

The study area, located in southern France (Fig. 1) displays drastic contrasts in its landscape. It includes a national park (Parc National des Cévennes, established 1970) and a Special Area of Conservation (SAC) of the Natura 2000 network (European Union wide network of nature protection established under the 1992 Habitats Directive), where population density is low (<50 people per km 2 ). Most of the land outside villages is covered by holm oak (Quercus ilex) forests and chestnut (Castanea sativa) coppices [START_REF] Gondard | Plant species diversity changes in abandoned chestnut (Castanea sativa) groves in southern France[END_REF]). Thus we could expect apiary products from the area to show background TE levels.

Yet the region also has a mining history: Les Malines, where an estimated 1 Mt. ore was extracted from 1885 to 1991 remains the largest Zn-Pb mine ever exploited in France [START_REF] Leguen | Lead isotope behavior in a polyphased Pb-Zn ore deposit -Les Malines (Cévennes, France)[END_REF]. Former mines were listed from national surveys (BRGM., 2012) and confronted with local knowledge. Locations where soil and apiary products were collected are indicated on Fig. 1.

Previous studies on the les Malines mining district reported high TE levels in soil and the occurrence of several metal hyperaccumulator plant species [START_REF] Escarre | Heavy metal concentration survey in soils and plants of the les malines mining district (Southern France): Implications for soil restoration[END_REF][START_REF] Grison | Thlaspi caerulescens, an indicator of soil pollution?[END_REF]. High TE levels in fish have been reported in a similar context elsewhere in the region [START_REF] Monna | Wild Brown Trout Affected by Historical Mining in the Cevennes National Park France[END_REF], but to date no studies have been conducted on apiary products in the area. As positive relationships regarding Pb traceability were validated along the soil-melliferous flora-honeybees-honey chain [START_REF] Mihaly Cozmuta | Lead traceability along soil-melliferous flora-bee family-apiary products chain[END_REF], such a study was necessary to assess honey quality from a heavily contaminated area.

Methods and materials

General

All reagents used in this study were of high purity grades: commercial HNO 3 , HCl and H 2 O 2 were obtained from the Sigma-Aldrich TraceSELECT Ò range. All solutions were prepared using double deionised water (Milli-Q Millipore 18.2 MO cm at 21 °C).

WEPAL IPE 110 and house standards were used as reference materials for apiary products analyses. BIPEA soil sample 402 (inter laboratory certification) was used as a reference material for soil analyses. For each digestion procedure, blank and standard digestions were carried out the same way and analysed for controls. ICP-MS analyses were performed with a Thermo scientific X Series II ICP-MS (Plateforme AETE -Hydrosciences, Montpellier -France) using In and Bi as internal standards.

Apiary products

Collection of apiary products was performed by beekeepers according to their usual harvest plans. Chestnut honey is collected from June to July. Four apiaries located in Saint-Laurent-le-Minier (les Avinières), Saint-Bresson, Aulas and Majencoules were sampled as stated in Table 3. Honey samples were obtained in generic glass jars used by beekeepers for honey retail, so as to assess the ele-mental content of honey as sold to potential consumers. Each jar contained 500 g honey, which allowed for measurement replicates and quality control using the standard addition method. Royal jelly and beeswax were taken directly from the hives and stored in clean polyethylene jars. An open vessel wet-digestion protocol adapted from [START_REF] Tuzen | Trace element levels in honeys from different regions of Turkey[END_REF], proved efficient to recover on average 93% of the TE from apiary products. Samples were warmed to 30 °C and homogenised before 3 g samples were taken for analysis. 12 ml of an oxi-acidic mixture (2:1 HNO 3 :H 2 O 2 ) were added per gram sample and the resulting solution was heated at 100 °C until dry (6 h). Dry residues were solubilised in HNO 3 (2.5% v:v) for analysis.

Soil

Samples were taken from horizon A (Table 3). S1-S3 are not actually soil but mining waste and tailings; S4, S6 and S7 are a mixture of mineral soil and humus found around beehives (S4, S7) and pastoral areas in Saint-Laurent-le-Minier (S6); S5 and S8 are a mixture of mineral soil and waste expelled from beehives by bees. Soil samples were treated according to a house procedure: dried at 60 °C until the weight was stable, sieved to 2 mm and approximately 120 mg were treated with (i) 4 ml H 2 O 2 (ii) 4 ml HNO 3 2 and3). (iii) 4 ml HNO 3 :HCl (1:3). In each step, the resulting solution was heated at 100 °C until dry. Dry residues obtained after step (iv) were solubilised in HNO 3 (2.5% v:v) for analysis.

Results and discussion

Soil TE content

In a risk-based approach, French authorities issued guideline values for contaminated land management as stated in Table 1. Fixed Impact Values (FIVs), based on toxicity studies, consider the chronic risks to public health related to the actual land use: 'sensitive use' values were selected here due to the occurrence of human activities (housing, beekeeping). These values were defined to be used in a specific scoring framework, but may also provide information on the level of concern for a specific site [START_REF] Carlon | Derivation of soil screening values in Europe. A review and evaluation of national procedures towards harmonisation[END_REF].

Measurements of the TE levels in soils are shown in Table 2. S1 and S2 taken from the les Avinières mine spoils and tailing ponds show the highest TE content, with values for Zn, As, Cd, Tl and Pb largely above the FIVs. Soil from the Les Malines tailing ponds (S3) was very similar, except for its lower Tl content. Our measurements confirm that mining waste from the area should be considered highly contaminated. The other soils were all below the FIVs for Zn and Cd meaning that the Zn or Cd contents of samples S4 through to S8 should not be considered as potential threats to public health. Values for As, on the other hand, all exceed FIVs with an average 3.4-fold FIV for As. In this case, the potential toxicity and high concentrations of As should be taken seriously. Tl and Pb are more contrasted with a few values above the FIVs. However, there is a clear trend of a decrease in Tl and Pb concentrations (Table 2) as the distance from the mines increased. Such a phenomenon is very likely to be related to dust transport by winds, a phenomenon previously reported for other historical mines [START_REF] Sondergaard | Pb isotopes as tracers of mining-related Pb in lichens, seaweed and mussels near a former Pb-Zn mine in West Greenland[END_REF].

One case of Pb early stage poisoning was reported in the area. It highlights the crucial need for further investigation in contaminant linkages. Water and wind erosion may result in widespread TE contamination with potential impacts on human health, activities and livelihoods [START_REF] Conesa | The Cartagena -La Union mining district (SE spain): A review of environmental problems and emerging phytoremediation solutions after fifteen years research[END_REF]. Precautionary measures such as restrictions on the use of local wells for water supplies, and on the trade of locally produced vegetables are currently enforced. To our knowledge, the possibility of safe beekeeping in such a context was never considered.

TE content of honey

Ca, Mg and P with average levels (±standard deviation) at 175 ± 74.1, 97.7 ± 44.9 and 72.4 ± 20.6 mg.kg À1 are the main cations present in honey (Table 3). Mn and Zn are next, with average levels of 7.57 ± 3.69, and 0.571 ± 0.440 mg.kg À1 , respectively, which were consistent with references herein. These elements are known for their physiological role and their presence in honey is of lesser concern.

A higher Zn content of statistical significance (Wilcoxon test, z = À2.460, P = 0.0139) could be measured in honey samples H1 and H3-5 collected in the vicinity of mine dumps (<250 m) compared to H2, H6-9 collected further away (>1500 m). However all honey from the region (H8 and H9 in particular) showed rather low Zn contents compared to the literature (Table 4). Floral composition was previously emphasised as a possible factor [START_REF] Bogdanov | Minerals in honey: environmental geographical and botanical aspects[END_REF] and the use of galvanised containers was reported as a major source of Zn [START_REF] Gonzalez-Paramas | Geographical discrimination of honeys by using mineral composition and common chemical quality parameters[END_REF]: such containers were not used in this case. Thus historical mining appears to have little influence on the Zn content of honey, an observation consistent with those by [START_REF] Bogdanov | Minerals in honey: environmental geographical and botanical aspects[END_REF] or [START_REF] Lambert | Bees, honey and pollen as sentinels for lead environmental contamination[END_REF].

The presence of other TE could be related to historical mining, namely Pb (mean 23 -min 3 -max 101 lg.kg À1 ), Tl (mean 12 -min 1 -max 37 lg kg À1 ), Cd (mean 6 -min 1 -max 22 lg kg À1 ) and As (mean 2 -min 0 -max 8 lg kg À1 ). H8 and H9, which reflect background TE levels in honey from the region, actually show the lowest As and Cd levels, but an exception occurs for Tl, with a high Tl level in H8. However, H3 harvested in the vicinity of the les Avinières mine dumps, shows the highest Pb (101 lg kg À1 ), Tl (37 lg kg À1 ) and Cd (22 lg kg À1 ) levels, which correlates with our data in soil. However statistical analysis cannot relate TE levels to the presence or absence of historical mines. No significant differences in Pb, Tl, Cd and As levels could be highlighted using distance to mine as an explanatory variable (Wilcoxon test P > 0.05). Besides, Pb, Cd and As levels observed here are all below the highest values previously observed in honey (Table 4), and within the concentration ranges previously described.

Our measurements appear to confirm the views expressed by [START_REF] Bogdanov | Minerals in honey: environmental geographical and botanical aspects[END_REF]. Apiary products TE content is not directly related to the mineral content of the foraging area, and cannot provide quantitative information on environmental TE levels. As a result, honey production in a historical mining area also appears to be safe.

TE content of royal jelly and beeswax

Measurements on other apiary products, including royal jelly (RJ) and bees wax (W) were also performed (Table 3). The most abundant elements in royal jelly are those necessary for larvae development: Ca, P, Mg, Zn and Mn, which is consistent with previous studies [START_REF] Stocker | Trace and mineral elements in royal jelly and homeostatic effects[END_REF]. Leita, Muhlbachova, Cesco, Barbattini, & Mondini (1996) highlighted higher Cd, Pb and Zn content in royal jelly compared to the corresponding honey, which is not consistent with homeostasis observations by [START_REF] Stocker | Trace and mineral elements in royal jelly and homeostatic effects[END_REF]. In our case, the TE levels were comparable (H3, RJ).

Regarding elements that could be related to historical mining (Zn, Pb, Cd, Tl), concentrations in royal jelly are of the same order of magnitude as those previously reported outside mining districts [START_REF] Bogdanov | Contaminants of bee products[END_REF], and once again no impacts of mining could be inferred from statistical analysis of our measurements. The same trend was observed for beeswax, which had a low Pb, Cd and Tl content. The low mineral content of beeswax should be noticed and detract from using it for TE monitoring.

Potential health hazards resulting from honey consumption

Defining acceptable TE levels in honey

The issue of potential health hazards related to the TE contamination of honey is usually left aside, possibly because of a lack of legislation to define acceptable TE levels in honey and other apiary products [START_REF] Devillers | Chemometrical analysis of 18 metallic and nonmetallic elements found in honeys sold in France[END_REF]. It is stated by the Codex Alimentarius, that 'honey shall be free from heavy metals in amounts, which may represent a hazard to human health' [START_REF] Alimentarius | Standard For Honey[END_REF]. Yet these hazardous levels are not defined, and in the European Union for example, regulation EC 1881/2006, which set the maximum levels for certain contaminants in foodstuffs does not address apiary products. Nonetheless, levels measured here for Pb and Cd in honey are all below the maximum levels stated by regulation EC 1881/2006 (Table 5).

Bioavailability and consumption trends

Although TE bioavailability from honey is high [START_REF] Pohl | Bioaccessibility of Ca, Cu, Fe, Mg, Mn and Zn from commercial bee honeys[END_REF] consumption trends are determinant to assess the risks. For our sample with the highest TE content (H3 with 0.101 lg g À1 Pb and 0.022 lg g À1 Cd), a 20 g daily honey consumption for an average 65 kg person turns into a weekly intake of 0.218 lg Pb per kg body-weight and a monthly intake of 0.203 lg Cd per kg body-weight. These intakes only represent about 0.9% of the Provisional Tolerable Weekly Intake (PTWI) for Pb and 0.8% of the Provisional Tolerable Monthly Intake (PTMI) for Cd (fixed by the World Health Organisation, namely 25 lg Pb per kg body-weight per week and 25 lg Cd per kg body-weight per month) (Food, 2010). Thus honey appears to be a minor component in TE intakes, a result previously emphasised in other studies [START_REF] Pohl | Bioaccessibility of Ca, Cu, Fe, Mg, Mn and Zn from commercial bee honeys[END_REF].

Nonetheless measurements in honey from les Malines showed Tl levels sometimes superior to that of Pb or Cd. Tl is more toxic than Pb/Cd and commonly appears in Zn sulphide ores. Thus, it is found at high concentrations in Zn-mine tailings [START_REF] Peter | Thallium: A review of public health and environmental concerns[END_REF]. Its presence in honey was not previously investigated. Additional data on the occurrence of this element in apiary products and other food products from the mining district could help assess the Tl content related to the presence of mine dumps and potential Tl impacts on health.

Conclusion

According to our results, in an environment heavily affected by historical mining, where soils are notoriously contaminated with TE, apiary products remain of good quality with regards to two aspects: (i) the levels of TE measured were consistent with those usually found in uncontaminated areas, as shown from literature datasets (ii) according to WHO guidelines, the consumption of honey appears to be safe: a simple calculation for Pb and Cd taking into account the usually low honey consumption and its low mineral content, clearly show that it only introduces a very small fraction of these toxic elements into the diet. Consumption of other apiary products such as royal-jelly is very likely to be even lower, representing a very minor part of dietary minerals intakes. This could explain why reference levels for noxious TE in honey have so far not been set. It also appears from our study, that apiary products should not be used for TE biomonitoring. In the case of historical mining, no clear contaminant linkage appear from mining waste to apiary products. The possible remediation options for historical mines are often subject to much discussion, although potential public exposure and impacts have not always been thoroughly investigated. In the case of Les Malines, our measurements showed that beekeeping could be safely performed and should not be restricted. It could maintain livelihoods as chestnut honey from the region is highly regarded for its unique taste. However, the case of other less studied TE, such as Tl, deserves further investigation.

Fig. 1 .

 1 Fig. 1. Location of historical mines and sampling sites (sample names in accord with Table2 and 3).

Table 1

 1 French guide values for soils TE content ('sensitive use' mg kg À1 dry weight).

	Element	Zn	As	Cd	Tl	Pb
	FIVs	9000	37	20	10

Table 3

 3 Apiary products elemental contents (mg kg À1 or lg kg À1 fresh weight) kg À1 lg kg À1 lg kg À1 lg kg À1 Soil elemental contents (mg kg À1 dry weight). Distance from the closest mine, which is les Avinières for samples collected in Saint-Laurent-le-Minier and Font-Bouillens for samples collected in Saint-Bresson.

	Table 2
	Sample	Type		Location	Distance from mine a (m)	Cr	Mn	Cu	Zn	As	Cd	Tl	Pb
	S1	Mine spoils		Les Avinières	0			13	248	11.2	86 706 *	4 247 *	408 *	317 *	66 388 *
	S2	Mine tailings		Les Avinières	0			na	559	981	125 456 *	734 *	1 605 *	37.1 *	88 472 *
	S3	Mine tailings		Les Malines	0			na	1310	929	56 999 *	103 *	386 *	6.45	3 686 *
	S4	Soil around beehives	Les Avinières	250			37.2	1131	29	3 684	147 *	8.79	16.1 *	1 234 *
	S5	Soil under beehives	Les Avinières	250			29.9	745	21.2	2 513	125 *	7.47	9.5	858 *
	S6	Soil		St-Laurent	500			37.3	696	89.1	2 879	75 *	8.26	3.6	1 787 *
	S7	Soil around beehives	St-Bresson	1500			19.4	3 767	30.8	50.8	159 *	<dl	4.8	379
	S8	Soil under beehives	St-Bresson	1500			12.3	1 842	48.3	202	127 *	<dl	2.6	369
	<dl = value below detection limit.
	Sample	Location	Distance from mine * (m)	Season	Mg	P		Ca	Mn	Zn	As	Cd	Tl	Pb
	H1	les Avinières	250		04.2011	80.5	40.7		187	5.81	0.806	1	9	6	3
	H2	St-Bresson	1500		05.2011	122	78.4		204	9.17	0.556	1	4	1	35
	H3	les Avinières	250		05.2011	125	115		219	6.77	1.4	3	22	37	101
	H4	les Avinières	250		06.2011	44.8	65.6		76.7	3.22	0.905	1	3	6	11
	H5	les Avinières	250		07.2011	163	66.6		277	10.5	0.613	1	1	12	9
	H6	St-Bresson	1500		06.2011	101	80.1		200	7.86	0.429	8	6	13	5
	H7	St-Bresson	1500		07.2011	66	82.3		168	10.6	0.429	2	3	19	25
	H8	Aulas	4000 a		2011	32.8	59.4		36.4	1.38	<dl	<dl	1	12	6
	H9	Majencoule	7500 b		2011	145	62.8		206	12.8	<dl	1	1	3	14
	RJ	les Avinières	250		05.2011	33.8	61.7		123	0.304	0.906	5	7	<dl	168
	W	les Avinières	250		05.2011	167	78.8		305	16.1	1.520	12	6	13	<dl
	Unit					mg kg À 1	mgkg À1	mg kg À1	mg kg À1	mg kg À1

lg <dl = value below detection limit. * Distance from the closest mine, which is les Avinières for samples collected in Saint-Laurent-le-Minier and Font-Bouillens for samples collected in Saint-Bresson a Distance from the mine located in Bez-et-Esparron. b Distance from the les Jumeaux mine in Sumène. a * Values above FIVs; na = not available.

Table 4

 4 Maximum TE levels previously reported in honey (mg.kg -1 fresh weight)

	Element	Max	Source	Element	Max	Source
	Mg	373	Pohl et al. (2009)	Cu	34.6	Pohl et al. (2009)
	Al	132	Pohl et al. (2009)	Zn	113	Pohl et al. (2009)
	P	398	Devillers et al. (2002)	As	1.93	Terrab et al. (2005)
	Ca	900	Pohl et al. (2009)	Se	0.09	Terrab et al. (2005)
	Cr	4.48	Gonzalez-Paramas et al. (2000)	Cd	5.78	Pohl et al. (2009)
	Mn	82	(Stankovska, Stafilov, & Sajn, 2008)	Ba	2.63	Pisani et al. (2008)
	Co	2.46	Pohl et al. (2009)	Hg	1.35	Pohl et al. (2009)
	Ni	13	Pohl et al. (2009)	Pb	8.22	Pohl et al. (2009)

Table 5

 5 Maximum and minimum TE levels from regulation EC 1881/2006.

		Cd	Pb
	Max	1 mg kg À1	1.5 mg kg À1
	Product	Bivalve molluscs	Bivalve molluscs
	Min	50 lg kg À1	20 50 lg kg À1
	Product	Meat	Milk

Acknowledgements

The authors gratefully acknowledge the CNRS, the ANR ECOTECH (11ECOT01101), the FEDER and ADEME for financial support. Particular thanks go to the Ecole Polytechnique -Paris Tech for a PhD studentship. We would also like to thank Remi Freydier (Plateforme AETE -Hydrosciences, Montpellier -France) for ICP-MS analyses and Raphaelle Leclerc (CEFE UMR-5175 platform of chemical analyses -LabEx CeMEB -Mediterranean Center For Environment and Biodiversity) for guidance in sample treatment. Finally, we would like to thank Mr. Daniel Favas, a beekeeper from Saint-Laurent-le-Minier, France and member of the local honeybees health preservation group (GDSA, Gard) for his active help in supplying samples.