tech-net archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: Support for 240/4 and 0/8 addresses in NetBSD



The attached patch addresses the 240/4 question by:

1. removing the hard-coded logic in the kernel to refuse forwarding of
   packets to 240/4 addresses, and

2. creating a route on network start that blackholes it, like we
   already do for various IPv6 address ranges like 2001:db8::/32.

(Perhaps we should do the same for 192.0.2.0/24, 198.51.100.0/24, and
203.0.113.0/24 and anything else relevant I might have missed in
<https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml>.)

I think it's best to address the 240/4, 0/8, and 127/8 questions
separately, because they pose very different types of risks: both 0/8
and 127/8 have had semantics imbued on them by standards for years,
some of which are security-critical like applications relying on 127/8
packets never leaving the host.  In contrast, 240/4 has just been
reserved, from what I understand, and nobody has ever come up with a
special-purpose use for it.

No need for new sysctl knobs or extra complexity in the kernel -- if
the operator wants to change it to experiment with the allocation,
they can just delete the route in /etc/rc.local.

Objections?


Home | Main Index | Thread Index | Old Index