OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: how to bind smtp client to specific address?
From: Rafi Sadowsky (rafimeron.openu.ac.il)
Date: Wed Mar 29 2000 - 23:20:08 CST

Open University of Israel | (PGP key -> ) http://telem.openu.ac.il/~rafi

On Wed, 29 Mar 2000, Wietse Venema wrote:

> Rafi Sadowsky:
> >
> >
> > On Wed, 29 Mar 2000, Wietse Venema wrote:
> > [deleted[
> > >
> > > Hmm. That behavior (ignoring the IP address given to bind() before
> > > calling connect()) should break other applications than Postfix.
> > Sorry - I guess some clarification is needed - the "broken" behavior of
> > Solaris is with regards to interfaces on the same subnet
> > (this is OTOH and too late at night - corrections welcome ....)
> >
   [deleted]
> > As for multi-homed(IP addresses in different subnets) hosts with only
> > 1 IP address per subnet ( you can extrapolate on multi-homed with multiple
> > addresses per subnet yourself if you must ;-( )
> > AFAIK the source IP address should be that of the exit interface
> > (the one that the destination IP address is routed through)
> > which should be OK for your below examples - right ?
>
> No. In the case of IDENT and FTP, the source IP address of a connection
> made by the wrapper or by ftpd should be bound to the destination address
> that was specified by the client.
>
> Wietse
Not even assuming symetrical routing ?
 (not reasonable on a WAN or with some load-balancing devices -
 but reasonable if both interfaces are on the same LAN)

        Rafi
>
> > Regards
> >
> > Rafi
> >
> > P.S. I haven't experimented with this on Solaris 7 or 8 ( yet ... ;-)
> >
> > >
> > > One example is IDENT lookups from a multi-homed host. These must
> > > be made with the proper source IP address or the lookup fails.
> > >
> > > Another example is paranoid FTP clients that reject DATA connections
> > > coming from the "wrong" server IP address.
> > >
> > > Wietse
> > >
> > >
> >
> >
> >
> >
>
>