From owner-freebsd-net@FreeBSD.ORG  Thu Dec 29 22:04:59 2005
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
X-Original-To: freebsd-net@freebsd.org
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 2F77D16A41F
	for <freebsd-net@freebsd.org>; Thu, 29 Dec 2005 22:04:59 +0000 (GMT)
	(envelope-from julian@elischer.org)
Received: from a50.ironport.com (a50.ironport.com [63.251.108.112])
	by mx1.FreeBSD.org (Postfix) with ESMTP id E5F9143D55
	for <freebsd-net@freebsd.org>; Thu, 29 Dec 2005 22:04:58 +0000 (GMT)
	(envelope-from julian@elischer.org)
Received: from unknown (HELO [10.251.17.229]) ([10.251.17.229])
	by a50.ironport.com with ESMTP; 29 Dec 2005 14:04:58 -0800
X-IronPort-Anti-Spam-Filtered: true
Message-ID: <43B45D8A.7040609@elischer.org>
Date: Thu, 29 Dec 2005 14:04:58 -0800
From: Julian Elischer <julian@elischer.org>
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US;
	rv:1.7.11) Gecko/20050727
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: FreeBSD Net <freebsd-net@freebsd.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: forwarding icmp redirects.
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 29 Dec 2005 22:04:59 -0000

I know WE don't generate non local icmp redirects but I notice that we
would forward them should someone else (malicious or not) generate them.. 
I think that we possibly should check for them in our forwarding code..
(of course you can stop them with the firewall but..)


thoughts?