Re: Discarding inbound ICMP REDIRECT by default

> > > > Discarding ICMP redirects on a internet host is non-conformant with
> > > > STD-3 via rfc-1122.  Processing of ICMP rediects is a MUST for hosts.
> > >
> > > In that case our default of "auto" is non-conformant if you have a
> > > routing daemon.
> >
> > NO, because then your not subject to rfc-1122 as your now a router,
> > not a host.
> 
> I would argue that having IP forwarding enabled (i.e.
> net.inet.ip.forwarding for IPv4) is what establishes FreeBSD as a
> router, and ICMP REDIRECT messages are already dropped in kernel in
> that case.

Yet another mistake by FreeBSD.  These ICMP dropping or not dropping
are SITE SPECIFIC POLICIES, and should never be hard coded to wrong
knobs.

One can easily be using FreeBSD as a router inside an AS that has
a need for ICMP REDIRECT to pass  through that router unfiltered.

But I would agree in general that the better detection mechanism for
the "auto" keyword of /etc/rc.conf icmp_drop_redirects is probably
the value of net.inet.ip.forwarding and net.inet6.ip6.forwarding,
but iirc the is an ordering issue.  Could use the *GATWEAY_ENABLE
rc.conf variables though.

-- 
Rod Grimes                                                 [email protected]