Hi Jason, On Thu, Aug 10, 2017 at 04:29:54PM +0200, Jason A. Donenfeld wrote: > 1. Packet from peer P arrives from src:A dst:B > 2. WireGuard records that it should contact P at src:B dst:A > 3. When sending an encrypted packet to P, it asks for which interface > to use for src:B dst:A. The routing API returns interface I. > 4. We ask whether interface I has an address B assigned to it. If yes, > we transmit the packet as src:B dst:A using interface I, and return. > If no, we move to step 5: > 5. We ask which interface and src IP we should use for src:default > dst:A. The routing API returns interface I' (which may be the same as > I or perhaps not) and a default src address, B', for interface I'. > 6. We transmit the packet as src:B' dst:A using interface I'. > > In the past, this has been sufficient for handling issues with > multihomed servers, while still dealing gracefully with IP address > changes. > > It seems like the problem you're facing is that B does not belong to > I, because B belongs to an unrouted dummy0 interface. The solution > would be to change the question of step 4 to instead ask if _any_ > interface contains B, not just the returned interface I. While this is > essentially what's done for IPv6, I'm not certain this is the correct > behavior for IPv4. Do you know of any relevant RFCs for your use of v4 > dummy interfaces and RTS routing? Or some other reference?
This is essentially a difference of weak vs. strong host model, see https://tools.ietf.org/html/rfc1122#page-61 The RFC is quite clear: If the datagram is sent in response to a received datagram, the source address for the response SHOULD be the specific-destination address of the request. However, a system with a strong host model would drop the incoming packets in the first place, still from the RFC: A host MAY silently discard an incoming datagram whose destination address does not correspond to the physical interface through which it is received. A host MAY restrict itself to sending (non-source-routed) IP datagrams only through the physical interface that corresponds to the IP source address of the datagrams. But Linux has adopted the weak host model, see for instance the documentation for "arp_filter" and "arp_announce" in Documentation/networking/ip-sysctl.txt. So I think your proposed change makes sense, you should use the destination address of the request as source address, even if this address is not assigned to the outgoing interface. Baptiste
Description: PGP signature
_______________________________________________ WireGuard mailing list WireGuard@lists.zx2c4.com https://lists.zx2c4.com/mailman/listinfo/wireguard