Subject: RE: [Tsvwg] sctp

From: "Amit Goel" <[email-masked]>
Date: Wed, 21 Jun 2006 10:03:27 -0700

Hi Brian,

>Amit Goel wrote:                           (Wed, 21 Jun 2006 01:44:57)
>> 
>> If an SCTP implementation uses raw sockets and also populates the 
>> source address in the IP Header itself, for HB-ACK / SACK messages 
>> does it need to care about filling correct source address (interface 
>> on which data packet arrived) , or can SCTP also be careless about it

>> since there is no response expected for an ACK.
>
> In general the source IP address can be any IP address belonging to
the 
> association at the sending endpoint.  The exception is, of course, the

> INIT-ACK chunk whose source IP address must be the destination IP
address 
> to which the INIT was sent, and the recommendations in RFC 4460
Section 2.39.

Imagine that two multihomed endpoints are connected as follows:

Endpoint 1          Endpoint 2
A-----------------------A'
B-----------------------B'

Where, two interfaces belong to different subnets, i.e. A and A' are on
subnet-1 and B,B' on a different subnet-2 which is mutually exclusive
with the subnet-1.

A SACK packet going from A to A' but actually having B in the source
address field may be rejected by routers of subnet-1. (if routers are
having some policy to look at the source address as well)

Can this be a problematic scenario, or I am missing something?

Thanks,
Amit.

---

From: "Brian F. G. Bidulock" <[email-masked]>
Date: Wed, 21 Jun 2006 15:44:28 -0600

Michael,

Michael Tuexen wrote:                (Wed, 21 Jun 2006 23:27:55)
>
> This means that you are sending packets from an interface with a
> source address of a different interface. This is pretty bad, because
> routers  might do ingress filtering and throw away your packet. So
> choose an  appropriate IP-address.

Routers can always be set to discard packets.

> Yes, it is. This means that you can not send packets on the upper
> network, because routers will drop it (which is OK). If you have a
> network  failure in the lower network, the association will break.  So
> if you send a SACK to A', use the above interface and A as the  source
> address.  If you send a SACK to B', use the lower interface and b as
> the source  address.

RFC 4460 Section 2.39 recommends a policy for retransmitted packets but
recommends no policy for other packets (except INIT-ACK), and true,
that is really the address list.

So if a packet is sent from A -> A' with a source address of interface
B and some router discards it, retransmission, according to Section 2.39,
needs to be sent to address A' with source address B (the most
divergent combination), which will likely cause that packet to be
dropped.  However, if a router is discarding packets in this fashion
and the routing tables are so messed up, it I don't think that the
association will ever form.

What I have seen is when interface A is down, a host can send packets
packets addressed A->A' (_or_ addressed B->A') on subnet B->B' if
there is a route to A' on subnet B (i.e. especially when A, A' and B, B'
are on the same subnet).  One does not normally have a route to A'
on subnet B-B' unless they are on the same subnet.

--brian

-- 
Brian F. G. Bidulock
[email-masked]
http://www.openss7.org/

---

From: Michael Tuexen <[email-masked]>
Date: Wed, 21 Jun 2006 23:27:55 +0200

Hi Amit,

see my comments in-line.

Best regards
Michael

> having some policy to look at the source address as well)
This means that you are sending packets from an interface with a source
address of a different interface. This is pretty bad, because routers  
might
do ingress filtering and throw away your packet. So choose an  
appropriate
IP-address.
Yes, it is. This means that you can not send packets on the upper  
network,
because routers will drop it (which is OK). If you have a network  
failure
in the lower network, the association will break.
So if you send a SACK to A', use the above interface and A as the  
source address.
If you send a SACK to B', use the lower interface and b as the source  
address.