diff options
| author | Jun-ichiro itojun Hagino <itojun@cvs.openbsd.org> | 2000-03-12 04:18:48 +0000 |
|---|---|---|
| committer | Jun-ichiro itojun Hagino <itojun@cvs.openbsd.org> | 2000-03-12 04:18:48 +0000 |
| commit | 40f62cc7bcd3fba6ad0328ea3defb80b9c316aff (patch) | |
| tree | ac08c9fba99704de9e20ca4c1fae247513accee0 /etc | |
| parent | 34d588196ed3579ca49680603443b66c492d1793 (diff) | |
disallow packets to malicious 6to4 prefix, based on
http://playground.iijlab.net/i-d/draft-itojun-ipv6-transition-abuse-00.txt
Diffstat (limited to 'etc')
| -rw-r--r-- | etc/netstart | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/etc/netstart b/etc/netstart index 71ee9b6479f..6d982ff3dc8 100644 --- a/etc/netstart +++ b/etc/netstart @@ -1,6 +1,6 @@ #!/bin/sh - # -# $OpenBSD: netstart,v 1.64 2000/03/10 13:21:51 todd Exp $ +# $OpenBSD: netstart,v 1.65 2000/03/12 04:18:47 itojun Exp $ # Returns true if $1 contains only alphanumerics isalphanumeric() { @@ -53,6 +53,11 @@ if ifconfig lo0 inet6 >/dev/null 2>&1; then # disallow "internal" addresses to appear on the wire. route add -inet6 ::ffff:0.0.0.0 -prefixlen 96 ::1 -reject route add -inet6 ::0.0.0.0 -prefixlen 96 ::1 -reject + # disallow packets to malicious 6to4 prefix + route add -inet6 2002:e000:: -prefixlen 20 ::1 -reject + route add -inet6 2002:7f00:: -prefixlen 24 ::1 -reject + route add -inet6 2002:0000:0000:: -prefixlen 48 ::1 -reject + route add -inet6 2002:ffff:ffff:: -prefixlen 48 ::1 -reject rtsolif="" else |