Re: [babel] Minor clarification to HMAC

[Markus Stenberg <[e-mail]>]

> On 29 Jun 2019, at 13.37, Juliusz Chroboczek <[e-mail]> wrote:
>> I think I am being dense (I haven’t looked at the protocol in awhile),
> 
> Perhaps we're not undestanding each other.  Let's work it out.
> 
>> a) babel-hmac does not have even reference to link-local address, and
> 
> Section 4.1:
> 
>   First, the node builds a pseudo-header that will participate in HMAC
>   computation but will not be sent.
>   [...]
>   Src address   The source IP address of the packet.
> 
> RFC 6126bis Section 4:
> 
>   A Babel packet MUST be silently ignored unless its source address is
>   either a link-local IPv6 address or an IPv4 address belonging to the
>   local network, and its source port is the well-known Babel port.

Ah ok, I didn’t read it through again (just did some searching), so that’s correct. Non-issue for most part.

> I don't think that's the case.  (And if you're right, then it's a serious
> flaw indeed.)

So at most you can have # of network size spurious replayed neighbour table entries. No idea how limited implementations might behave with that (e.g. fixed neighbour table size in a largish network with same HMAC key), but I think that given security consideration text it is fine then as long as the behavior is mentioned somewhere.

-Markus