diff options
| author |   claudio <claudio@openbsd.org> | 2018-02-10 08:46:10 +0000 |
|---|---|---|
| committer | claudio <claudio@openbsd.org> | 2018-02-10 08:46:10 +0000 |
| commit | 55db05fd790dc80d08fe5f32b0cc9ffcf2f89814 (patch) | |
| tree | ada99f48f8d9bcde32cdbd410f5e7144e672bf16 | |
| parent | rework gif to be more consistent. (diff) | |
| download | wireguard-openbsd-55db05fd790dc80d08fe5f32b0cc9ffcf2f89814.tar.xz wireguard-openbsd-55db05fd790dc80d08fe5f32b0cc9ffcf2f89814.zip | |
Remove some special IPv4 in IPv6 mapped prefixes that are already rejected
by the ::0.0.0.0/96 reject route added to deny all IPv4 mapped addresses.
Makes the inet6 routing table almost fit in one screen.
OK benno@
| -rw-r--r-- | etc/netstart | 8 |
1 files changed, 1 insertions, 7 deletions
diff --git a/etc/netstart b/etc/netstart index 820c1607deb..8a46cd2ad45 100644 --- a/etc/netstart +++ b/etc/netstart @@ -1,6 +1,6 @@ #!/bin/sh - # -# $OpenBSD: netstart,v 1.189 2018/02/10 05:56:47 florian Exp $ +# $OpenBSD: netstart,v 1.190 2018/02/10 08:46:10 claudio Exp $ # Turn off Strict Bourne shell mode. set +o sh @@ -230,12 +230,6 @@ if ifconfig lo0 inet6 >/dev/null 2>&1; then # Disallow "internal" addresses to appear on the wire. route -qn add -inet6 ::ffff:0.0.0.0 -prefixlen 96 ::1 -reject >/dev/null - # Disallow packets to malicious IPv4 compatible prefix. - route -qn add -inet6 ::224.0.0.0 -prefixlen 100 ::1 -reject >/dev/null - route -qn add -inet6 ::127.0.0.0 -prefixlen 104 ::1 -reject >/dev/null - route -qn add -inet6 ::0.0.0.0 -prefixlen 104 ::1 -reject >/dev/null - route -qn add -inet6 ::255.0.0.0 -prefixlen 104 ::1 -reject >/dev/null - # Disallow packets to malicious 6to4 prefix. route -qn add -inet6 2002:e000:: -prefixlen 20 ::1 -reject >/dev/null route -qn add -inet6 2002:7f00:: -prefixlen 24 ::1 -reject >/dev/null |