Re: Networks and wireless etc

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

"Eugene Gershnik" <gershnik@xxxxxxxxxxx> wrote in message
news:uYD3juNfFHA.484@xxxxxxxxxxxxxxxxxxxxxxx
> Alun Jones [MSFT] wrote:
>> If you bind a socket to a particular IP address, that will be the
>> source address indicated in outgoing packets on that socket, and must
>> be the destination address on incoming packets for that socket. However,
>> outgoing packets will go out whichever NIC is the "closest"
>> (by metric) and "most exact match" for network destination in the
>> routing table, regardless of the source address.
>
> So it appears you predict the following behavior:
>
> Case 1: Two disjoint networks A and B (both non-loopback). Routing table
> properly configured.
>
> bind(A);
> connect(B);
>
> Result: SYN goes out on B but SYN-ACK is never delivered. connect times
> out

I believe that is the behaviour you would expect, if the machine on network
B does not have a route back to your source machine that will actually reach
it. (Would you expect anything else? After all, if the packet was sent out
on network A, it would not be replied to either, under those circumstances)

> Case 2: One network A accessible through two adapters A1 and A2. Routing
> tables are properly configured with A1 having the lower metric.
>
> bind(A2);
> connect(A);
>
> Result: SYN goes out on A1 but SYN-ACK is delivered on A2. And so on. All
> outgoing traffic goes from A1 and incoming is received on A2. connect is
> successfull as are all subsequent communications.

That is mostly correct. The route that the SYN-ACK comes back in on will
depend on the routing table at the remote machine.

> Does this correctly describe what you are saying?

Yes, it does seem to - but trying it out on a simple machine would be the
easiest way to verify it.

> If this is true this would be a big usability and possibly security hole
> but who knows. I have been wrong in the past and I didn't have time to
> check this directly yet. FWIW my expectations would be

It's not a security hole - unless you don't understand it, and make security
decisions based on it happening in a different way.

> Case 1: No SYN packet goes out as destination is unreachable

The "destination is unreachable" message is received at the host on network
B that you connect to, when it tries to send the SYN-ACK back.

> Case 2: The SYN packet and the rest of outgoing traffic goes from A2. The
> connection is established in the usual manner.

Nope - the bind() doesn't do anything except establish the local IP address
of the socket in use.

Here's an article from December 2001 detailing IP routing for IPv4:

http://www.microsoft.com/technet/community/columns/cableguy/cg1201.mspx

The wrinkle comes in IPv6, where it acts more like you want:

http://www.microsoft.com/technet/community/columns/cableguy/cg1002.mspx

[In each article, look for the part labeled "Route Determination Process"]

Note - this is one more reason why it's a bad idea to call bind() before
calling connect().

Alun.
~~~~
--
Software Design Engineer, Internet Information Server (FTP)
This posting is provided "AS IS" with no warranties, and confers no rights.


.

Relevant Pages