Re: [babel] Minor clarification to HMAC

[Juliusz Chroboczek <[e-mail]>]

> I think I am being dense (I haven’t looked at the protocol in awhile),

Perhaps we're not undestanding each other.  Let's work it out.

> a) babel-hmac does not have even reference to link-local address, and

Section 4.1:

   First, the node builds a pseudo-header that will participate in HMAC
   computation but will not be sent.
   [...]
   Src address   The source IP address of the packet.

RFC 6126bis Section 4:

   A Babel packet MUST be silently ignored unless its source address is
   either a link-local IPv6 address or an IPv4 address belonging to the
   local network, and its source port is the well-known Babel port.

> Doesn’t this mean that by forging the link-local addresses (which are
> not included in HMAC)

They are included in HMAC computation, see citation from 4.1 above.

> and then replaying valid HMAC packets you can fill table as you want if
> this consideration is relaxed?

I don't think that's the case.  (And if you're right, then it's a serious
flaw indeed.)

-- Juliusz