make the bogon set competely or-longer, rather than having to manage it

or-longer at useage time.
ok job benno

1 files changed, 27 insertions, 28 deletions

diff --git a/etc/examples/bgpd.conf b/etc/examples/bgpd.conf
index ed825c049ce..d0c8bb05163 100644
--- a/etc/examples/bgpd.conf
+++ b/etc/examples/bgpd.conf
@@ -1,4 +1,4 @@
-# $OpenBSD: bgpd.conf,v 1.14 2018/09/10 09:10:36 claudio Exp $
+# $OpenBSD: bgpd.conf,v 1.15 2018/11/17 17:22:38 deraadt Exp $
 # example bgpd configuration file, see bgpd.conf(5)
 
 # define our own ASN as a macro
@@ -16,31 +16,31 @@ prefix-set mynetworks {		\
 
 # define bogon prefixes which should not be part of the DFZ
 prefix-set bogons {
-	0.0.0.0/8		# 'this' network [RFC1122]
-	10.0.0.0/8		# private space [RFC1918]
-	100.64.0.0/10		# CGN Shared [RFC6598]
-	127.0.0.0/8		# localhost [RFC1122]
-	169.254.0.0/16		# link local [RFC3927]
-	172.16.0.0/12		# private space [RFC1918]
-	192.0.2.0/24		# TEST-NET-1 [RFC5737]
-	192.88.99.0/24		# 6to4 anycast relay [RFC7526]
-	192.168.0.0/16		# private space [RFC1918]
-	198.18.0.0/15		# benchmarking [RFC2544]
-	198.51.100.0/24		# TEST-NET-2 [RFC5737]
-	203.0.113.0/24		# TEST-NET-3 [RFC5737]
-	224.0.0.0/4		# multicast
-	240.0.0.0/4		# reserved for future use
-	::/8			# RFC 4291 IPv4-compatible, loopback, et al
-	0100::/64		# Discard-Only [RFC6666]
-	2001:2::/48		# BMWG [RFC5180]
-	2001:10::/28		# ORCHID [RFC4843]
-	2001:db8::/32		# docu range [RFC3849]
-	2002::/16		# 6to4 anycast relay [RFC7526]
-	3ffe::/16		# old 6bone
-	fc00::/7		# unique local unicast
-	fe80::/10		# link local unicast
-	fec0::/10		# old site local unicast
-	ff00::/8		# multicast
+	0.0.0.0/8 or-longer		# 'this' network [RFC1122]
+	10.0.0.0/8 or-longer		# private space [RFC1918]
+	100.64.0.0/10 or-longer		# CGN Shared [RFC6598]
+	127.0.0.0/8 or-longer		# localhost [RFC1122]
+	169.254.0.0/16 or-longer	# link local [RFC3927]
+	172.16.0.0/12 or-longer		# private space [RFC1918]
+	192.0.2.0/24 or-longer		# TEST-NET-1 [RFC5737]
+	192.88.99.0/24 or-longer	# 6to4 anycast relay [RFC7526]
+	192.168.0.0/16 or-longer	# private space [RFC1918]
+	198.18.0.0/15 or-longer		# benchmarking [RFC2544]
+	198.51.100.0/24 or-longer	# TEST-NET-2 [RFC5737]
+	203.0.113.0/24 or-longer	# TEST-NET-3 [RFC5737]
+	224.0.0.0/4 or-longer		# multicast
+	240.0.0.0/4 or-longer		# reserved for future use
+	::/8 or-longer			# RFC 4291 IPv4-compatible, loopback, et al
+	0100::/64 or-longer		# Discard-Only [RFC6666]
+	2001:2::/48 or-longer		# BMWG [RFC5180]
+	2001:10::/28 or-longer		# ORCHID [RFC4843]
+	2001:db8::/32 or-longer		# docu range [RFC3849]
+	2002::/16 or-longer		# 6to4 anycast relay [RFC7526]
+	3ffe::/16 or-longer		# old 6bone
+	fc00::/7 or-longer		# unique local unicast
+	fe80::/10 or-longer		# link local unicast
+	fec0::/10 or-longer		# old site local unicast
+	ff00::/8 or-longer		# multicast
 }
 
 # Generate routes for the networks our ASN will originate.
@@ -114,8 +114,7 @@ allow from any inet6 prefixlen 16 - 48
 # https://tools.ietf.org/html/rfc8326
 match from any community GRACEFUL_SHUTDOWN set { localpref 0 }
 
-# use prefix-set to reject the bogons
-deny quick from any prefix-set bogons or-longer
+deny quick from any prefix-set bogons
 
 # filter bogon AS numbers
 # AS_TRANS (23456) is not supposed to show up in any path and indicates a