i don't think we should forward packets with certain source addresses,
and 0.0.0.0 in particular.

my initial motivation here is that ip_output special cases 0.0.0.0 and
replaces it with an ip from the local system under the assumption that
an unset ip originates from the local system.

in addition to this, my reading of rfc1122 makes me think it's illegal
from a standards point of view too.

however, i do think we should continue to treat packets from 0.0.0.0
on a connected network as valid because dhcp needs to do this. ie,
we should accept packets from 0.0.0.0, but not forward them.

i discovered this because there's a clever clogs dhcp implementation
somewhere at work that knows it hasn't got an address yet, but it tries
talking to the dhcp server that last gave it an ip, which is on a
different subnet in my topology. this means it sends a unicast ip packet
from 0.0.0.0 to the ip of my dhcp server via the gateway on that subnet,
which is pretty presumptuous of it.

at the moment my router tries to forward this, and it ends up changing
the source ip on the packet to one of its addresses. this diff should
make our ip stack drop the packet instead of forwarding it.

i havent run this on the firewall yet though. it's pretty simple though,
so should be easy to discuss.

thoughts?

Index: ip_input.c
===================================================================
RCS file: /cvs/src/sys/netinet/ip_input.c,v
diff -u -p -r1.428 ip_input.c
--- ip_input.c	26 May 2026 20:43:31 -0000	1.428
+++ ip_input.c	8 Jun 2026 01:17:20 -0000
@@ -1579,7 +1579,9 @@ ip_forward(struct mbuf *m, struct ifnet 
 	u_int32_t dest;
 
 	dest = 0;
-	if (m->m_flags & (M_BCAST|M_MCAST) || in_canforward(ip->ip_dst) == 0) {
+	if (m->m_flags & (M_BCAST|M_MCAST) ||
+	    in_canforward(ip->ip_dst) == 0 ||
+	    ip->ip_src.s_addr == INADDR_ANY) {
 		ipstat_inc(ips_cantforward);
 		m_freem(m);
 		goto done;