RE: Source address selection insufficient?

["Christian Huitema" <huitema@windows.microsoft.com>]

> > Correct. If the only thing you do is try the four pairs, it may
happen
> > that no pair works. It is somewhat unlikely in practice, since sites
> > tend to have a "default" provider, and the pair default-default ends
up
> > working. But it is definitely a possibility, in a "shoot your-self
in
> > the foot" kind of way.
> 
> Does this mean that we can remove the two solutions in your draft
> (solution 2 and 7) which use source address selection as the means
> to avoid ingress filtering issues?

Source address selection will work in a lot of practical cases, e.g.
whenever there is a "default" route. Source address selection is also
adequate in some very practical multi-homing cases, where the different
site exits lead to disjoint subsets of the Internet -- back-door routing
scenarios.

> > Locator rewriting supposes that both sites (X and Y) cooperate. If
that
> > is the case, you can also implement an end-to-end solution, e.g. X
sends
> > "A:X-C:Y", Y replies A:X-D:Y, and both decide to agree on the
result.
> 
> Not only that - it also assumes that the peer host has been modified
> to be able to handle locators that are rewritten.
> Thus it would take longer to deploy etc. etc.
> 
> > Relaxed filtering and source-based routing are "local" solutions:
they
> > make no hypothesis on the behavior of the remote site.
> 
> Agreed.
> 
> > Source based routing is trivial to implement in single-subnet sites.
> 
> Yep. But it becomes a lot more complex as the site grows.

There is value in having a simple solution that works for a large
fraction of the sites. For example, we could make that an extension of
automatic address configuration. "If host X configures the address A:X
after hearing an announcement from router RA, then it should use router
RA as the next hop when the source address is set to A:X." Then, you can
add another simple rule for routers, "A router must not advertise an
address configuration prefix if it cannot safely route packets whose
source address is derived from that prefix." 

These two rules have very simple fall-back conditions: a host that
configures only one address must always use the advertising router as
default router; a router that cannot perform source-based routing must
advertise at most one prefix.

> If we decide that source-based routing only applies to a subset of the
> sites, e.g. due to large sites being able to use relaxed filtering,
then 
> the incentive for wide-spread implementation of these more complex
> techniques might be a challenge.

Whatever we do for connection survival, we should have a special effort
dedicated to ingress-filtering, and come up with a simple
recommendation.

-- Christian Huitema