Re: ipfilter, return-icmp and RFC1122

[Petar Bogdanovic <petar%smokva.net@localhost>]

On Wed, Jun 04, 2008 at 03:03:06PM +0200, Petar Bogdanovic wrote:
> Hi,
> 
> I recently noticed that ipfilter with `block return-icmp' is returning
> ICMP Type 3 Code 0 (Network unreachable) to the sender of a blocked
> broadcast:
> 
>       130.3.3.3 ---------[UDP%130.3.3.255@localhost]--------> 130.3.3.4
>       130.3.3.3 <----[ICMP Network unreachable]---- 130.3.3.4
> 
> 
> This seems wrong, considering RFC1122, page 39:
> 
>          An ICMP error message MUST NOT be sent as the result of
>          receiving:
> 
>          *    an ICMP error message, or
> 
>          *    a datagram destined to an IP broadcast or IP multicast
>               address, or
> 
>          *    a datagram sent as a link-layer broadcast, or
> 
>          *    a non-initial fragment, or
> 
>          *    a datagram whose source address does not define a single
>               host -- e.g., a zero address, a loopback address, a
>               broadcast address, a multicast address, or a Class E
>               address.
> 
> 
> Is this desired behaviour?
> 
> My ipf.conf:

Oops, while removing the comments I removed the two most important
lines.  Here is my complete ipf.conf:

         pass in  quick on lo0 all
         pass out quick on lo0 all

         block in quick from 192.168.0.0/16 to any
         block in quick from 172.16.0.0/12 to any
         block in quick from 10.0.0.0/8 to any
         block in quick from 127.0.0.0/8 to any
         block in quick from 0.0.0.0/8 to any
         block in quick from 169.254.0.0/16 to any
         block in quick from 192.0.2.0/24 to any
         block in quick from 204.152.64.0/23 to any
         block in quick from 224.0.0.0/3 to any

         block out log first level auth.info quick from any to 192.168.0.0/16
         block out log first level auth.info quick from any to 172.16.0.0/12
         block out log first level auth.info quick from any to 10.0.0.0/8
         block out log first level auth.info quick from any to 127.0.0.0/8
         block out log first level auth.info quick from any to 0.0.0.0/8
         block out log first level auth.info quick from any to 169.254.0.0/16
         block out log first level auth.info quick from any to 192.0.2.0/24
         block out log first level auth.info quick from any to 204.152.64.0/23
         block out log first level auth.info quick from any to 224.0.0.0/3

         block in  all
         block out all

        +block return-rst  in proto tcp
        +block return-icmp in proto udp

         pass in  proto icmp icmp-type 3
         pass out proto icmp icmp-type 3

         pass in  proto icmp icmp-type 8 keep state
         pass out proto icmp icmp-type 8 keep state

         pass in proto udp from any to any port = 53 keep state
         pass in proto tcp from any to any port = 22 flags S keep state keep 
frags
         pass in proto tcp from any to any port = 25 flags S keep state keep 
frags
         pass in proto tcp from any to any port = 53 flags S keep state keep 
frags

         pass out proto udp from any to any port =  53 keep state
         pass out proto udp from any to any port = 123 keep state
         pass out proto tcp from any to any port =  25 flags S keep state keep 
frags
         pass out proto tcp from any to any port =  53 flags S keep state keep 
frags


Petar