Re: Discarding inbound ICMP REDIRECT by default
Ed Maste <[email protected]>
| Newsgroups | gmane.os.freebsd.devel.net |
|---|---|
| Message-ID | <CAPyFy2B2LQyqJ+zQzjdHfxj57=_Y-28ZzLPPr-bRES_c2x8=bA@mail.gmail.com> |
> > > Discarding ICMP redirects on a internet host is non-conformant with > > > STD-3 via rfc-1122. Processing of ICMP rediects is a MUST for hosts. > > > > In that case our default of "auto" is non-conformant if you have a > > routing daemon. > > NO, because then your not subject to rfc-1122 as your now a router, > not a host. I would argue that having IP forwarding enabled (i.e. net.inet.ip.forwarding for IPv4) is what establishes FreeBSD as a router, and ICMP REDIRECT messages are already dropped in kernel in that case.