Subject: [Sigtran] regarding INIT ACK from different destination IP.

From: Padmalochan Moharana <[email-masked]>
Date: Tue, 26 Sep 2006 00:17:42 -0700 (PDT)

Hi Brian

please suggest for the following doubt.

Should endoint (in case of Multi-homed), encode COOKIE
ECHO on receive the INIT_ACK from a different
destination IP of the INIT or it should  ignores the
INIT_ACK.

Br,
Padmalochan

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 

_______________________________________________
Sigtran mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/sigtran

---

From: "Brian F. G. Bidulock" <[email-masked]>
Date: Tue, 26 Sep 2006 01:27:09 -0600

Padmalochan,

Padmalochan Moharana wrote:         (Tue, 26 Sep 2006 00:17:42)
> destination IP of the INIT or it should  ignores the

If the INIT_ACK corresponds to an INIT that was sent (addresses
in the address list, verification tag, parameters and a cookie),
send the COOKIE ECHO.

Why would you think otherwise?

--brian

-- 
Brian F. G. Bidulock
[email-masked]
http://www.openss7.org/

---

From: "Ambika Tripathy" <[email-masked]>
Date: Tue, 26 Sep 2006 13:07:59 +0530

Hi Brain,

    The section 5.1.2 of the rfc-2960 tell some thing differnet regarding
the INIT_ACK transmission.
" Note: The INIT-ACK MUST be sent to the source address of the INIT."

There is such clear description present to transmit, INIT_ACK to an IP
address which is present in INIT's IP address list in case of multihomed end
point.

Is it an implementation dependent feature?

-- 
Br,
Ambika Prasad Tripathy
Cell: +91-94375 47730

---

From: Bhanu Prakash <[email-masked]>
Date: Tue, 26 Sep 2006 13:16:27 +0530

Brian,

Please refer RFC-4460:

************************************************
2.36.2.  Text Changes to the Document

   ---------
   Old text: None
   ---------

   ---------
   New text: (Section 5.4)
   ---------
   5.4.  Path Verification

   During association establishment, the two peers exchange a list of
   addresses.  In the predominant case, these lists accurately represent
   the addresses owned by each peer.  However, it is possible that a
   misbehaving peer may supply addresses that it does not own.  To
   prevent this, the following rules are applied to all addresses of the
   new association:

   1) Any address passed to the sender of the INIT by its upper layer is
      automatically considered to be CONFIRMED.

   2) For the receiver of the COOKIE-ECHO the only CONFIRMED address is
      the one that the INIT-ACK was sent to.

   3) All other addresses not covered by rules 1 and 2 are considered
      UNCONFIRMED and are subject to probing for verification.

******************************************************************

In this case since the INIT-ACK is received from an un-confirmed 
address, should
it be accepted or not..?

Thanks
Bhanuprakash.

---

From: "Brian F. G. Bidulock" <[email-masked]>
Date: Tue, 26 Sep 2006 02:01:51 -0600

Bhanu,

That passage does not say to drop the INIT-ACK.

--brian

Bhanu Prakash wrote:                                                 (Tue, 26 Sep 2006 13:16:27)

-- 
Brian F. G. Bidulock
[email-masked]
http://www.openss7.org/

---

From: Satya Prasad Nemana <[email-masked]>
Date: Tue, 26 Sep 2006 13:45:03 +0530

Ambika,

Source address here refers to the IP source address.

-Satya Prasad

Ambika Tripathy wrote:

> Hi Brain,
>  
>     The section 5.1.2 of the rfc-2960 tell some thing differnet 
> regarding the INIT_ACK transmission.
> address which is present in INIT's IP address list in case of 
> multihomed end point.
>  
> On 9/26/06, Brian F. G. Bidulock <[email-masked] 
> <mailto:[email-masked]>> wrote:
>
>     Padmalochan,
>
>     [email-masked] <mailto:[email-masked]>
>     http://www.openss7.org/
>
>     [email-masked] <mailto:[email-masked]>
>------------------------------------------------------------------------
>

---

From: "Brian F. G. Bidulock" <[email-masked]>
Date: Tue, 26 Sep 2006 02:18:46 -0600

Ambika,

Ambika Tripathy wrote:                                              (Tue, 26 Sep 2006 13:07:59)
>    address  which  is  present  in  INIT's  IP  address  list  in case of

That passage does not require the receiver of the INIT-ACK not to respond
to it.  Nor does it require an implementation to receive the INIT-ACK on
an IP address other than the source address of the corresponding INIT.
If I'm being strict about addresses, the destination address must be one
of my source addresses from the INIT.  If I'm not being strict about
addresses, I disregard the destination address altogether.

--brian

-- 
Brian F. G. Bidulock
[email-masked]
http://www.openss7.org/

---

From: Bhanu Prakash <[email-masked]>
Date: Tue, 26 Sep 2006 14:17:23 +0530

Brian,

In the same section please see the following explanation:

***********************

   An endpoint MUST NOT send any chunks to an UNCONFIRMED address, with
   the following exceptions:

   - A HEARTBEAT including a nonce MAY be sent to an UNCONFIRMED
     address.

   - A HEARTBEAT-ACK MAY be sent to an UNCONFIRMED address.

   - A COOKIE-ACK MAY be sent to an UNCONFIRMED address, but it MUST be
     bundled with a HEARTBEAT including a nonce.  An implementation that
     does NOT support bundling MUST NOT send a COOKIE-ACK to an
     UNCONFIRMED address.

   - A COOKE-ECHO MAY be sent to an UNCONFIRMED address, but it MUST be
     bundled with a HEARTBEAT including a nonce, and the packet MUST NOT
     exceed the path MTU.  If the implementation does NOT support
     bundling or if the bundled COOKIE-ECHO plus HEARTBEAT (including
     nonce) would exceed the path MTU, then the implementation MUST NOT
     send a COOKIE-ECHO to an UNCONFIRMED address.

************************

Thanks,
Bhanuprakash.

---

From: "Brian F. G. Bidulock" <[email-masked]>
Date: Tue, 26 Sep 2006 04:43:39 -0600

Bhanu,

All addresses provided by the user to the INIT are considered confirmed.
Therefore, the receiver of the INIT-ACK is welcomed to send a COOKIE-ECHO
to one of the addresses provided by the user for which the INIT was
launched.  It does not matter what destination address was in the INIT-ACK.

I think that you miss the point.  The INIT-ACK MUST be sent to the source
address of the INIT.  But the receiver of the INIT-ACK may ignore the
destination address in the message.

--brian

Bhanu Prakash wrote:                          (Tue, 26 Sep 2006 14:17:23)

-- 
Brian F. G. Bidulock
[email-masked]
http://www.openss7.org/