From nobody Fri Jun 14 12:50:09 2024 X-Original-To: freebsd-net@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4W0zdp2nyMz5Npqt for ; Fri, 14 Jun 2024 12:50:22 +0000 (UTC) (envelope-from carpeddiem@gmail.com) Received: from mail-io1-f45.google.com (mail-io1-f45.google.com [209.85.166.45]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "smtp.gmail.com", Issuer "WR4" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4W0zdn4Sf6z4QDq for ; Fri, 14 Jun 2024 12:50:21 +0000 (UTC) (envelope-from carpeddiem@gmail.com) Authentication-Results: mx1.freebsd.org; dkim=none; dmarc=fail reason="SPF not aligned (relaxed), No valid DKIM" header.from=freebsd.org (policy=none); spf=pass (mx1.freebsd.org: domain of carpeddiem@gmail.com designates 209.85.166.45 as permitted sender) smtp.mailfrom=carpeddiem@gmail.com Received: by mail-io1-f45.google.com with SMTP id ca18e2360f4ac-7eb7c5b12e3so82011639f.3 for ; Fri, 14 Jun 2024 05:50:21 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1718369420; x=1718974220; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=eFZ6RD4g9ZD+1gBz+elt34WUVKfiRwojVRNBQdQ2pqI=; b=tNtT6VweqJqixK52kOlPj50eCSxVZ+UIDWLDOoKgermU8GtKnHFSfpWQO6PIhGDWn2 EE1g1TOjmTY9m2S2hJrkTPb238rzp1LBCYyDwJdBxdwVAEj9MsQB3AiWIVY3J41rNZTL DFXuyQB0YRSKynZu49RGgauTHc6rFp+S2TTt8W+3t2I9/6PFNlUH2WOYspy4IHivfsze ji260ZUeUb8o/bqw3d1PM0r//Tk/dB3+z2jfFX+6HI7djxsNuxozaSeV/BMVIslQrptd X9F1E/mj2N9gBbj6iKIhltVIhX/N334y0t0t1YK885honij+AGK/yD1l8rZhRh/3koxD 2u9Q== X-Forwarded-Encrypted: i=1; AJvYcCVb1m/eHw0WIK/hyZQpcC5IQs+4S+ez5Ly8Y9otQVIr0hx5jZvnxEO1y1hF8MGVUVhLYBwTdaGKYm9RJcUcJRjsy5mCihFngg== X-Gm-Message-State: AOJu0YwCa5xCe3RPgH1DngVyfYw5DL8LYVCE86yonMN35OFotE8+mf3E PtQs4zwnO/2jids3mSOBy5/TG4vVe1Tbg1oE/VVkW0XnQJoY/xGs5bgreC2NntwNZ7JW8ONJNEt afNjAV+FoScyljtvxmgmqPTCz2ug= X-Google-Smtp-Source: AGHT+IE6n556ZFwxXhOMBHpsYvET6Qgr4FCvmBRajurGKvQMMJVjwx9kEpNFfImmu3o7hODC/2CoBmYL5iOF5QwFDrA= X-Received: by 2002:a05:6602:601c:b0:7eb:4d68:a56a with SMTP id ca18e2360f4ac-7ebeb62db57mr331715539f.17.1718369420516; Fri, 14 Jun 2024 05:50:20 -0700 (PDT) List-Id: Networking and TCP/IP with FreeBSD List-Archive: https://lists.freebsd.org/archives/freebsd-net List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-net@FreeBSD.org MIME-Version: 1.0 References: <202406122147.45CLlsgN042313@gndrsh.dnsmgr.net> <72ceb2fe26812a237a17bd8de4024b7f@bsdforge.com> In-Reply-To: <72ceb2fe26812a237a17bd8de4024b7f@bsdforge.com> From: Ed Maste Date: Fri, 14 Jun 2024 08:50:09 -0400 Message-ID: Subject: Re: Discarding inbound ICMP REDIRECT by default To: Chris Cc: "Rodney W. Grimes" , freebsd-net@freebsd.org Content-Type: text/plain; charset="UTF-8" X-Spamd-Bar: / X-Spamd-Result: default: False [-0.98 / 15.00]; NEURAL_HAM_LONG(-1.00)[-0.999]; NEURAL_HAM_MEDIUM(-0.88)[-0.883]; NEURAL_SPAM_SHORT(0.80)[0.799]; FORGED_SENDER(0.30)[emaste@freebsd.org,carpeddiem@gmail.com]; R_SPF_ALLOW(-0.20)[+ip4:209.85.128.0/17:c]; MIME_GOOD(-0.10)[text/plain]; DMARC_POLICY_SOFTFAIL(0.10)[freebsd.org : SPF not aligned (relaxed), No valid DKIM,none]; ARC_NA(0.00)[]; ASN(0.00)[asn:15169, ipnet:209.85.128.0/17, country:US]; MIME_TRACE(0.00)[0:+]; FREEMAIL_ENVFROM(0.00)[gmail.com]; FREEFALL_USER(0.00)[carpeddiem]; RCVD_COUNT_ONE(0.00)[1]; TO_DN_SOME(0.00)[]; RWL_MAILSPIKE_POSSIBLE(0.00)[209.85.166.45:from]; R_DKIM_NA(0.00)[]; MLMMJ_DEST(0.00)[freebsd-net@freebsd.org]; FROM_NEQ_ENVFROM(0.00)[emaste@freebsd.org,carpeddiem@gmail.com]; FROM_HAS_DN(0.00)[]; MISSING_XM_UA(0.00)[]; RCVD_IN_DNSWL_NONE(0.00)[209.85.166.45:from]; PREVIOUSLY_DELIVERED(0.00)[freebsd-net@freebsd.org]; TO_MATCH_ENVRCPT_SOME(0.00)[]; RCVD_TLS_LAST(0.00)[]; RCPT_COUNT_THREE(0.00)[3] X-Rspamd-Queue-Id: 4W0zdn4Sf6z4QDq On Wed, 12 Jun 2024 at 18:05, Chris wrote: > > As Rodeney already effectively explains; dropping packets makes routing, > and discovery exceedingly difficult. Which is NOT what the average user > wants, This is on end hosts only, not routers (which already drop ICMP REDIRECT). > or expects. I use "set block-policy drop" in pf(4). But as already noted, > this is for "filtering" purposes. Your suggestion also has the negative > affect > of hanging remote ports. Which can result in other negative results by peers. I don't follow -- how does a host not processing ICMP REDIRECT cause these effects?