spoofing non-routeable addresses

[Stefan Berg <stefan_(_dot_)_berg_(_at_)_cubical_(_dot_)_fi>]

Hello,

Creating a socket and binding it to the loopback address for a
non-listening socket have the side effect that it is possible to send
packets where the source address is the bound-to address and not the
routed-via interface address. E.g. create a socket, bind it to 127.0.0.1
and connect to a server with a valid address and we are sending packets
like

10:52:35.160047 127.0.0.1.49011 > 194.71.11.20.21: S
2040416480:2040416480(0) win 16384 <mss 1460,nop,nop,sackOK,nop,wscale
0,nop,nop,timestamp 723427440 0> (DF)

Is this the intended behavior, or should it be construed as a bug in
the BSD IP stack? An alternative would be having connect(2) return an
error when using a non-routeable source address.

Stefan