From owner-freebsd-net@FreeBSD.ORG  Thu Dec 29 22:27:07 2005
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
X-Original-To: freebsd-net@freebsd.org
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id BD6CA16A41F
	for <freebsd-net@freebsd.org>; Thu, 29 Dec 2005 22:27:07 +0000 (GMT)
	(envelope-from barney@pit.databus.com)
Received: from pit.databus.com (p72-0-224-2.acedsl.com [72.0.224.2])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 41D4343D4C
	for <freebsd-net@freebsd.org>; Thu, 29 Dec 2005 22:27:06 +0000 (GMT)
	(envelope-from barney@pit.databus.com)
Received: from pit.databus.com (localhost [127.0.0.1])
	by pit.databus.com (8.13.4/8.13.4) with ESMTP id jBTMOZsA047997;
	Thu, 29 Dec 2005 17:24:35 -0500 (EST)
	(envelope-from barney@pit.databus.com)
Received: (from barney@localhost)
	by pit.databus.com (8.13.4/8.13.3/Submit) id jBTMOZ3W047996;
	Thu, 29 Dec 2005 17:24:35 -0500 (EST) (envelope-from barney)
Date: Thu, 29 Dec 2005 17:24:35 -0500
From: Barney Wolff <barney@databus.com>
To: Julian Elischer <julian@elischer.org>
Message-ID: <20051229222435.GA32141@pit.databus.com>
References: <43B45D8A.7040609@elischer.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <43B45D8A.7040609@elischer.org>
User-Agent: Mutt/1.5.11
Cc: FreeBSD Net <freebsd-net@freebsd.org>
Subject: Re: forwarding icmp redirects.
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 29 Dec 2005 22:27:07 -0000

On Thu, Dec 29, 2005 at 02:04:58PM -0800, Julian Elischer wrote:
> I know WE don't generate non local icmp redirects but I notice that we
> would forward them should someone else (malicious or not) generate them.. 
> I think that we possibly should check for them in our forwarding code..
> (of course you can stop them with the firewall but..)

Why this particular one out of the semi-infinite set of malicious packets?

If I had to pick one, I'd drop packets arriving with a source IP that we
think is one of ours.

But in general I think FreeBSD should obey RFCs and match the good
behavior of widely used commercial routers.

-- 
Barney Wolff         http://www.databus.com/bwresume.pdf
I never met a computer I didn't like.