Subject: Source Address Selection

From: Pawel Hadam <[email-masked]>
Date: Thu, 20 Feb 2003 15:44:46 +0100

Hi all

In [RFC2960, 6.4] I may read:
"By default, an endpoint SHOULD always transmit to the primary path,
unless the SCTP user explicitly specifies the destination transport
address (AND POSSIBLY SOURCE TRANSPORT ADDRESS) to use."

And later in [RFC2960, 6.4.1]:
"Note: Rules for picking the most divergent source-destination pair
are an implementation decision and is not specified within this
document."

So I have the following questions:
- are there any ideas/proposals about the SOURCE network address selection?
- are there any work in progress about it?

As I can see now, the SOURCE network address for a packet is chosen
by the routing system on the base of the destination address chosen
by SCTP. But I would like to see some solution that will let me choose "manualy" the SOURCE network address for each outgoing
packet. And, I would like to have some rules to decide about the
SOURCE network address.

Is anobody involved in some work like this, or is it still an untouched
area?

-- 
Best regards
Pawel Hadam

---

From: "Randall Stewart (cisco)" <[email-masked]>
Date: Thu, 20 Feb 2003 10:02:06 -0600

Pawel:

Comments below..

>Is anobody involved in some work like this, or is it still an untouched

Yes, there is some work going on in this area. I recently have had 
contact with

Katsuyoshi Iida <[email-masked]>
and
Toshiyuki Kubo <[email-masked]>

Kubo-san as just finished his masters thesis covering some
of this area (hopefully he will make his findings public soon). 

Also I believe the draft on multi-homing that Lode Coene is editor of 
also discusses this.

I also put a solution to this (somewhat) in the kame/bsd implementation
when RADIX_MPATH and SCTP_ALTERNATE_ROUTE is enabled.

First of all there are a general set of rules one should apply
when possible for source address selection...

1) Always, if possible, use the source address of the interface
   you will emit the packet on. This means that routing becomes a
   big factor... This is why I put the options in the bsd implementation.. one
   must have the ability to have more than one route to a peer in order
   to have different interfaces.

2) If you can't do <1> then you need to pick a reasonable alternate src address
   with which to use (possibly rotating amongst the available ones in some
   cases).

3) One must also take into account that most endhosts will be connected via one
   (or more) ISP's which may well do address filtering to protect against 
    DOS attacks.. this means that if you can't use a source address that corresponds
    with the ISP's idea of your address assigned your packet will be filtered.. 
    Example. I have two ISP's A and B. and Two address ISP-A-IP and ISP-B-IP. If
    I send a packet to ISP-A default router address but use source address ISP-B-IP
    then chances are ISP-A will drop the packet.

4) In some cases (especially v6) one may have multiple sources that are valid
   to use in sending to the peer. In such a case one must choose a source using
   a scope that will most likely assure the peer can reach you, aka you must
   choose the same or higher scope of the destination address... some of this
   is discussed in the v6 and v4 scoping drafts...

Most kernel implementations DO source address selection.. I know ours does.. no
matter if the RADIX_MPATH/SCTP_ALTERNATE_ROUTE is enabled. In fact for IPv6 you
MUST do this (with kame) since you can't let the ip6_output choose a source
address...

There are still areas to look at for sure.. but some of what I have
mentioned will be a good start for your investagation..

R

-- 
Randall R. Stewart
ITD
Cisco Systems Inc.
[email-masked] 815-342-5222(cell) or 815-477-2127(office)