RE: Thinking differently about the site local problem (was: RE: site local addresses (was Re: Fw: Welcome to the InterNAT...))

["Jeroen Massar" <[e-mail]>]

Christian Huitema wrote:

> Well, that is emphatically *NOT* what application developers 
> do. They do not just observe that it does not work, they try
> to work around, e.g. routing messages to a different address,
> at a different time, through a third party, or through a
> different protocol. 

Indeed, correctly coded applications will use a getaddrinfo()
and then a connect() in a loop until succesful. This will
also overcome filtering as all possibilities will be tried
on the remote side. Note that 'succesful' here means that
it was able to setup a tcp connection. UDP is totally out
of the question here. Some applications could also modify
'succesful' to include a 2xx smtp reply etc. and absolute
failure to be defined by a 5xx error.

The problem is that this doesn't account for the locally-bound
IP though. Thus if a host has a 'site-local' and a 'global'
IP how does it know how to use which one?
Also note that getaddrinfo() is only in use since a couple
of years and most programmers are not even aware of it.

I would suggest that the applications never bind() to a
local address, this is possible for most applications.
Then the stack can figure out which address to use for
the outgoing connection. Most stacks will currently base
this on longest prefix matching. Thus if there is a 'local'
scope and the destination address is also in the same
'local' prefix, this address will be used for the connection.

Greets,
 Jeroen