Date: Fri, 18 Jan 2002 13:20:01 -0800 (PST) From: "Crist J . Clark" <cristjc@earthlink.net> To: freebsd-bugs@FreeBSD.org Subject: Re: misc/33996: 127.0.0.0/8 not added to routing table by default Message-ID: <200201182120.g0ILK1F27705@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
The following reply was made to PR misc/33996; it has been noted by GNATS.
From: "Crist J . Clark" <cristjc@earthlink.net>
To: Ruslan Ermilov <ru@FreeBSD.ORG>
Cc: bug-followup@FreeBSD.ORG
Subject: Re: misc/33996: 127.0.0.0/8 not added to routing table by default
Date: Fri, 18 Jan 2002 13:07:05 -0800
On Fri, Jan 18, 2002 at 05:40:59PM +0200, Ruslan Ermilov wrote:
> On Fri, Jan 18, 2002 at 01:22:34AM -0800, Crist J . Clark wrote:
> > On Thu, Jan 17, 2002 at 08:30:02AM -0800, Ruslan Ermilov wrote:
> > > The following reply was made to PR misc/33996; it has been noted by GNATS.
> > >
> > > From: Ruslan Ermilov <ru@FreeBSD.org>
> > > To: Aragon Gouveia <aragon@phat.za.net>
> > > Cc: bug-followup@FreeBSD.org
> > > Subject: Re: misc/33996: 127.0.0.0/8 not added to routing table by default
> > > Date: Thu, 17 Jan 2002 18:20:01 +0200
> > >
> > > On Thu, Jan 17, 2002 at 08:02:01AM -0800, Aragon Gouveia wrote:
> > > >
> > > >
> > > > The reserved 127.0.0.0/8 range is not added to FreeBSD's routing
> > > > table with destination interface lo0 by default. Instead, only
> > > > 127.0.0.1/32 is being routed to the loopback interface. Pinging,
> > > > for example, 127.2.3.4 returns no response - in my case it tries
> > > > to route via the default route out onto the net!
> > > >
> > > Nah, this is something that should be controlled with a firewall.
> > > The default ipfw(8) rules block this. Also, the kernel function
> > > in_canforward() does not allow forwarding of IP packets with the
> > > destination address in the 127.0.0.0/8 range.
> > >
> > > Can this PR be closed now?
> >
> > Well, there is a bug here. Have you ever actually tried,
> >
> > # ping 127.2.3.4
> >
> > And sniffed the wire? That is a Bad Thing. No machine should ever let
> > 127/8 on the wire. But I believe there is another PR on this.
> >
> Yes I tried, and I get EACCES from ipfw(4) because of these lines:
>
> 00100 allow ip from any to any via lo0
> 00200 deny ip from any to 127.0.0.0/8
> 00300 deny ip from 127.0.0.0/8 to any
>
> :-)
OK,
# ipfw d 200
# ping 127.2.3.4
The point being that even without firewalling enabled, I don't think
that packets destined for 127/8 should ever leave a host. Well, it's
not just me who thinks so, it is a requirement (RFC1122),
(g) { 127, <any> }
Internal host loopback address. Addresses of this form
MUST NOT appear outside a host.
--
Crist J. Clark | cjclark@alum.mit.edu
| cjclark@jhu.edu
http://people.freebsd.org/~cjc/ | cjc@freebsd.org
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200201182120.g0ILK1F27705>