From owner-freebsd-net@FreeBSD.ORG  Fri Dec 30 05:01:55 2005
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
X-Original-To: freebsd-net@freebsd.org
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 10BE816A41F;
	Fri, 30 Dec 2005 05:01:55 +0000 (GMT)
	(envelope-from julian@elischer.org)
Received: from delight.idiom.com (outbound.idiom.com [216.240.47.197])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 854E243D55;
	Fri, 30 Dec 2005 05:01:52 +0000 (GMT)
	(envelope-from julian@elischer.org)
Received: from idiom.com (idiom.com [216.240.32.1])
	by delight.idiom.com (Postfix) with ESMTP id 06FE22297D8;
	Thu, 29 Dec 2005 21:01:52 -0800 (PST)
Received: from [192.168.2.4] (home.elischer.org [216.240.48.38])
	by idiom.com (8.12.11/8.12.11) with ESMTP id jBU51oa7016192;
	Thu, 29 Dec 2005 21:01:51 -0800 (PST)
	(envelope-from julian@elischer.org)
Message-ID: <43B4BF3E.9070907@elischer.org>
Date: Thu, 29 Dec 2005 21:01:50 -0800
From: Julian Elischer <julian@elischer.org>
User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.7.12) Gecko/20051120
X-Accept-Language: en, hu
MIME-Version: 1.0
To: Andre Oppermann <andre@freebsd.org>
References: <43B45D8A.7040609@elischer.org> <43B47A31.2CABFD7D@freebsd.org>
In-Reply-To: <43B47A31.2CABFD7D@freebsd.org>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Cc: freebsd-net@freebsd.org
Subject: Re: forwarding icmp redirects.
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 30 Dec 2005 05:01:55 -0000

Andre Oppermann wrote:
> Julian Elischer wrote:
> 
>>I know WE don't generate non local icmp redirects but I notice that we
>>would forward them should someone else (malicious or not) generate them..
>>I think that we possibly should check for them in our forwarding code..
>>(of course you can stop them with the firewall but..)
>>
>>thoughts?
> 
> 
> The job of the forwarding code is to forward packets with little to
> no exceptions.  Dropping certain types of ICMP packets is out of scope
> for the forwarding code.  The proper place is a firewall.
> 
> IMHO we should disable emitting and acting upon ICMP redirects by default.

I know many places that rely on them heavily.. please don't do that..
Cisco PIX doesn't generate them.. it makes that machine a pain in the ****
to use in some situations.

>