tech-net archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: ipfilter, return-icmp and RFC1122

>> I recently noticed that ipfilter with `block return-icmp' is
>> returning ICMP Type 3 Code 0 (Network unreachable) to the sender of
>> a blocked broadcast:

>> ---------[UDP%]-------->
>> <----[ICMP Network unreachable]----

>> This seems wrong, considering RFC1122, page 39:

>>          An ICMP error message MUST NOT be sent as the result of
>>          receiving:
>>          *    a datagram destined to an IP broadcast or IP multicast
>>               address, [...]

>       +block return-icmp in proto udp

I would say that the resulting behaviour is, strictly, wrong, but that
it's not ipf's fault: it's doing exactly what you told it to do.

I do not see any reason why ipf - or most other pieces of software, for
that matter - have to make it impossible, or even difficult, to violate
standards.  Just as I don't expect to be prevented from deleting the
postmaster alias in my mailer, or running as an "ordinary"
Ethernet if I try, I don't expect ipf to impose all the Host
Requirements on me.

/~\ The ASCII                           der Mouse
\ / Ribbon Campaign
 X  Against HTML     
/ \ Email!           7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B

Home | Main Index | Thread Index | Old Index