From 8311ed12d38b3d27e66f01edab799a3aab036a99 Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Tue, 14 Jul 2026 12:11:33 +0200 Subject: [PATCH 1/2] fix(network-policies): default-deny CNPs for external-secrets, woodpecker-ci; openbao egress MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Closes the gaps from #194: external-secrets and woodpecker-ci had no CiliumNetworkPolicy at all (Cilium defaults to allow-all absent one), and openbao-ns.yaml had an ingress-only CNP with no egress block, which leaves egress from openbao pods completely unenforced rather than merely permissive. - external-secrets-ns.yaml: default-deny-ingress; egress scoped to the namespace, DNS, and the openbao KV API on :8200 (the only ClusterSecretStore in this cluster) plus host/remote-node for kube-apiserver (webhook admission, Secret watch/create, leader election). - woodpecker-ci-ns.yaml: this namespace hosts only ephemeral, sometimes privileged, pipeline-defined step pods (no static workloads) — the goal is blocking lateral movement into unrelated namespaces while still allowing the git clone (east-west via k8s_gateway -> traefik, since gitea.renner.uno now has an in-cluster Ingress) and the broad internet egress every CI system legitimately needs (image pulls, package managers). - openbao-ns.yaml: added an egress block (DNS, intra-namespace, host/ remote-node for the k8s auth method + kubelet) so egress enforcement is actually turned on, not just missing. music-assistant is deliberately NOT covered here: its only workload runs hostNetwork: true, so a namespace-scoped CiliumNetworkPolicy would select no enforceable pod-network endpoint and be a no-op (same documented limitation as the rook-ceph Ceph daemons). Left for a comment on #194 rather than shipping a policy that looks protective but isn't. Co-Authored-By: Claude Bot --- .../network-policies/external-secrets-ns.yaml | 142 ++++++++++++++++ .../network-policies/kustomization.yaml | 2 + .../network-policies/openbao-ns.yaml | 23 +++ .../network-policies/woodpecker-ci-ns.yaml | 159 ++++++++++++++++++ 4 files changed, 326 insertions(+) create mode 100644 kubernetes/infrastructure/network-policies/external-secrets-ns.yaml create mode 100644 kubernetes/infrastructure/network-policies/woodpecker-ci-ns.yaml diff --git a/kubernetes/infrastructure/network-policies/external-secrets-ns.yaml b/kubernetes/infrastructure/network-policies/external-secrets-ns.yaml new file mode 100644 index 00000000..c40d9500 --- /dev/null +++ b/kubernetes/infrastructure/network-policies/external-secrets-ns.yaml @@ -0,0 +1,142 @@ +apiVersion: cilium.io/v2 +kind: CiliumNetworkPolicy +metadata: + name: default-deny-ingress + namespace: external-secrets +spec: + endpointSelector: {} + ingress: + # Intra-namespace — controller ↔ webhook ↔ cert-controller. + - fromEndpoints: + - matchLabels: + "k8s:io.kubernetes.pod.namespace": external-secrets + # kube-apiserver (host identity in Cilium) drives the ExternalSecret/ + # SecretStore validating webhook and the controller's watch/list/create + # calls. Without this, every ExternalSecret apply hangs the admission + # webhook call and gets rejected — same pattern as database-ns.yaml's + # CNPG webhook rule. + - fromEntities: + - host + - remote-node + # ICMP — all standard ICMPv4 + ICMPv6 from any cluster pod. See + # home-assistant-ns.yaml for the rationale. + - fromEndpoints: + - matchExpressions: + - key: io.kubernetes.pod.namespace + operator: Exists + icmps: + - fields: + - { type: 0, family: IPv4 } + - { type: 3, family: IPv4 } + - { type: 4, family: IPv4 } + - { type: 5, family: IPv4 } + - { type: 8, family: IPv4 } + - { type: 9, family: IPv4 } + - { type: 10, family: IPv4 } + - { type: 11, family: IPv4 } + - { type: 12, family: IPv4 } + - { type: 13, family: IPv4 } + - { type: 14, family: IPv4 } + - { type: 15, family: IPv4 } + - { type: 16, family: IPv4 } + - { type: 17, family: IPv4 } + - { type: 18, family: IPv4 } + - { type: 30, family: IPv4 } + - { type: 1, family: IPv6 } + - { type: 2, family: IPv6 } + - { type: 3, family: IPv6 } + - { type: 4, family: IPv6 } + - { type: 128, family: IPv6 } + - { type: 129, family: IPv6 } + - { type: 130, family: IPv6 } + - { type: 131, family: IPv6 } + - { type: 132, family: IPv6 } + - { type: 133, family: IPv6 } + - { type: 134, family: IPv6 } + - { type: 135, family: IPv6 } + - { type: 136, family: IPv6 } + - { type: 137, family: IPv6 } + - { type: 138, family: IPv6 } + - { type: 141, family: IPv6 } + - { type: 142, family: IPv6 } + - { type: 143, family: IPv6 } + - { type: 148, family: IPv6 } + - { type: 149, family: IPv6 } + - { type: 151, family: IPv6 } + - { type: 152, family: IPv6 } + - { type: 153, family: IPv6 } + egress: + - toEndpoints: + - matchLabels: + "k8s:io.kubernetes.pod.namespace": external-secrets + # DNS resolution. + - toEndpoints: + - matchLabels: + "k8s:io.kubernetes.pod.namespace": kube-system + k8s-app: kube-dns + toPorts: + - ports: + - port: "53" + protocol: UDP + # KV API of the only ClusterSecretStore in this cluster (openbao, + # kubernetes/infrastructure/post-crds/openbao-clustersecretstore.yaml). + # Matches the existing ingress grant in openbao-ns.yaml. + - toEndpoints: + - matchLabels: + "k8s:io.kubernetes.pod.namespace": openbao + toPorts: + - ports: + - port: "8200" + protocol: TCP + # host/remote-node: kube-apiserver — watch/list/create Secret objects, + # leader-election Lease, cert-controller's webhook CA-bundle updates. + # No "world": the only SecretStore target is in-cluster openbao. + - toEntities: + - host + - remote-node + # ICMP — egress mirror; see ingress block above. + - toEndpoints: + - matchExpressions: + - key: io.kubernetes.pod.namespace + operator: Exists + icmps: + - fields: + - { type: 0, family: IPv4 } + - { type: 3, family: IPv4 } + - { type: 4, family: IPv4 } + - { type: 5, family: IPv4 } + - { type: 8, family: IPv4 } + - { type: 9, family: IPv4 } + - { type: 10, family: IPv4 } + - { type: 11, family: IPv4 } + - { type: 12, family: IPv4 } + - { type: 13, family: IPv4 } + - { type: 14, family: IPv4 } + - { type: 15, family: IPv4 } + - { type: 16, family: IPv4 } + - { type: 17, family: IPv4 } + - { type: 18, family: IPv4 } + - { type: 30, family: IPv4 } + - { type: 1, family: IPv6 } + - { type: 2, family: IPv6 } + - { type: 3, family: IPv6 } + - { type: 4, family: IPv6 } + - { type: 128, family: IPv6 } + - { type: 129, family: IPv6 } + - { type: 130, family: IPv6 } + - { type: 131, family: IPv6 } + - { type: 132, family: IPv6 } + - { type: 133, family: IPv6 } + - { type: 134, family: IPv6 } + - { type: 135, family: IPv6 } + - { type: 136, family: IPv6 } + - { type: 137, family: IPv6 } + - { type: 138, family: IPv6 } + - { type: 141, family: IPv6 } + - { type: 142, family: IPv6 } + - { type: 143, family: IPv6 } + - { type: 148, family: IPv6 } + - { type: 149, family: IPv6 } + - { type: 151, family: IPv6 } + - { type: 152, family: IPv6 } + - { type: 153, family: IPv6 } diff --git a/kubernetes/infrastructure/network-policies/kustomization.yaml b/kubernetes/infrastructure/network-policies/kustomization.yaml index 3664c064..372bc827 100644 --- a/kubernetes/infrastructure/network-policies/kustomization.yaml +++ b/kubernetes/infrastructure/network-policies/kustomization.yaml @@ -19,4 +19,6 @@ resources: - velero-ns.yaml - evcc-ns.yaml - openbao-ns.yaml + - external-secrets-ns.yaml + - woodpecker-ci-ns.yaml - allow-cilium-health.yaml diff --git a/kubernetes/infrastructure/network-policies/openbao-ns.yaml b/kubernetes/infrastructure/network-policies/openbao-ns.yaml index 6be5d826..a3fb0ff2 100644 --- a/kubernetes/infrastructure/network-policies/openbao-ns.yaml +++ b/kubernetes/infrastructure/network-policies/openbao-ns.yaml @@ -31,3 +31,26 @@ spec: - ports: - port: "8200" protocol: TCP + # This namespace was ingress-only (no egress block), which — per Cilium's + # semantics — means egress from openbao pods is entirely unenforced, not + # merely permissive. Adding an explicit egress block turns on enforcement + # and scopes it to what OpenBao itself actually needs. + egress: + - toEndpoints: + - matchLabels: + "k8s:io.kubernetes.pod.namespace": openbao + # DNS resolution. + - toEndpoints: + - matchLabels: + "k8s:io.kubernetes.pod.namespace": kube-system + k8s-app: kube-dns + toPorts: + - ports: + - port: "53" + protocol: UDP + # host/remote-node: kubelet probes + kube-apiserver (Kubernetes auth + # method token review, leader-election Lease, raft-snapshot CronJob's + # own apiserver calls). + - toEntities: + - host + - remote-node diff --git a/kubernetes/infrastructure/network-policies/woodpecker-ci-ns.yaml b/kubernetes/infrastructure/network-policies/woodpecker-ci-ns.yaml new file mode 100644 index 00000000..0b6c29f4 --- /dev/null +++ b/kubernetes/infrastructure/network-policies/woodpecker-ci-ns.yaml @@ -0,0 +1,159 @@ +# woodpecker-ci hosts no static workloads — the woodpecker-agent (apps +# namespace) dynamically creates one pod per pipeline step (kubernetes +# backend, kubernetes/apps/woodpecker/agent.yaml). Image-build steps run +# privileged (WOODPECKER_PLUGINS_PRIVILEGED), so this namespace is +# attacker-influenceable: pipeline definitions (.woodpecker.yaml) choose +# the step images and commands. This CNP's job is to stop lateral movement +# into unrelated in-cluster namespaces (openbao, home-assistant, monitoring, +# …) while still letting a build clone its repo, resolve DNS, and pull +# images/packages from the internet — the things every CI step legitimately +# needs. +apiVersion: cilium.io/v2 +kind: CiliumNetworkPolicy +metadata: + name: default-deny-ingress + namespace: woodpecker-ci +spec: + endpointSelector: {} + ingress: + # Intra-namespace — a pipeline's "service" containers (e.g. a postgres + # service backing an integration test, see rbac.yaml's services verb) + # are reached by sibling step pods over the pod network. + - fromEndpoints: + - matchLabels: + "k8s:io.kubernetes.pod.namespace": woodpecker-ci + # kubelet: exec/attach + `pods/log` streaming (the agent's log-tail + # RPC goes through kube-apiserver -> kubelet, not pod-to-pod). + - fromEntities: + - host + - remote-node + # ICMP — all standard ICMPv4 + ICMPv6 from any cluster pod. See + # home-assistant-ns.yaml for the rationale. + - fromEndpoints: + - matchExpressions: + - key: io.kubernetes.pod.namespace + operator: Exists + icmps: + - fields: + - { type: 0, family: IPv4 } + - { type: 3, family: IPv4 } + - { type: 4, family: IPv4 } + - { type: 5, family: IPv4 } + - { type: 8, family: IPv4 } + - { type: 9, family: IPv4 } + - { type: 10, family: IPv4 } + - { type: 11, family: IPv4 } + - { type: 12, family: IPv4 } + - { type: 13, family: IPv4 } + - { type: 14, family: IPv4 } + - { type: 15, family: IPv4 } + - { type: 16, family: IPv4 } + - { type: 17, family: IPv4 } + - { type: 18, family: IPv4 } + - { type: 30, family: IPv4 } + - { type: 1, family: IPv6 } + - { type: 2, family: IPv6 } + - { type: 3, family: IPv6 } + - { type: 4, family: IPv6 } + - { type: 128, family: IPv6 } + - { type: 129, family: IPv6 } + - { type: 130, family: IPv6 } + - { type: 131, family: IPv6 } + - { type: 132, family: IPv6 } + - { type: 133, family: IPv6 } + - { type: 134, family: IPv6 } + - { type: 135, family: IPv6 } + - { type: 136, family: IPv6 } + - { type: 137, family: IPv6 } + - { type: 138, family: IPv6 } + - { type: 141, family: IPv6 } + - { type: 142, family: IPv6 } + - { type: 143, family: IPv6 } + - { type: 148, family: IPv6 } + - { type: 149, family: IPv6 } + - { type: 151, family: IPv6 } + - { type: 152, family: IPv6 } + - { type: 153, family: IPv6 } + egress: + - toEndpoints: + - matchLabels: + "k8s:io.kubernetes.pod.namespace": woodpecker-ci + # DNS resolution. + - toEndpoints: + - matchLabels: + "k8s:io.kubernetes.pod.namespace": kube-system + k8s-app: kube-dns + toPorts: + - ports: + - port: "53" + protocol: UDP + # gitea.renner.uno has an in-cluster Ingress (kubernetes/apps/gitea/ + # ingress.yaml), so k8s_gateway resolves it to the Traefik LB and the + # clone step's git fetch stays east-west via traefik instead of + # hairpinning through the WAN. Matches netbird-ingress-egress.yaml's + # traefik port scoping. + - toEndpoints: + - matchLabels: + "k8s:io.kubernetes.pod.namespace": ingress + app.kubernetes.io/name: traefik + toPorts: + - ports: + - port: "8443" + protocol: TCP + # host/remote-node: kubelet. world: this is the deliberately broad rule + # — build steps need arbitrary internet reach for package managers and + # container-image pulls (docker/buildx, npm, pip, apk, …), same as + # every other namespace's image-pull/telemetry "world" grant (see + # spegel-ns.yaml, evcc-ns.yaml). The security value of this CNP is not + # restricting *that*; it's that east-west reach into unrelated + # namespaces (openbao, home-assistant, monitoring, …) stays denied. + - toEntities: + - host + - remote-node + - world + # ICMP — egress mirror; see ingress block above. + - toEndpoints: + - matchExpressions: + - key: io.kubernetes.pod.namespace + operator: Exists + icmps: + - fields: + - { type: 0, family: IPv4 } + - { type: 3, family: IPv4 } + - { type: 4, family: IPv4 } + - { type: 5, family: IPv4 } + - { type: 8, family: IPv4 } + - { type: 9, family: IPv4 } + - { type: 10, family: IPv4 } + - { type: 11, family: IPv4 } + - { type: 12, family: IPv4 } + - { type: 13, family: IPv4 } + - { type: 14, family: IPv4 } + - { type: 15, family: IPv4 } + - { type: 16, family: IPv4 } + - { type: 17, family: IPv4 } + - { type: 18, family: IPv4 } + - { type: 30, family: IPv4 } + - { type: 1, family: IPv6 } + - { type: 2, family: IPv6 } + - { type: 3, family: IPv6 } + - { type: 4, family: IPv6 } + - { type: 128, family: IPv6 } + - { type: 129, family: IPv6 } + - { type: 130, family: IPv6 } + - { type: 131, family: IPv6 } + - { type: 132, family: IPv6 } + - { type: 133, family: IPv6 } + - { type: 134, family: IPv6 } + - { type: 135, family: IPv6 } + - { type: 136, family: IPv6 } + - { type: 137, family: IPv6 } + - { type: 138, family: IPv6 } + - { type: 141, family: IPv6 } + - { type: 142, family: IPv6 } + - { type: 143, family: IPv6 } + - { type: 148, family: IPv6 } + - { type: 149, family: IPv6 } + - { type: 151, family: IPv6 } + - { type: 152, family: IPv6 } + - { type: 153, family: IPv6 } -- 2.54.0 From 2c349f728b1e0203f4e68a1d0389542c21da2d94 Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Tue, 14 Jul 2026 12:14:40 +0200 Subject: [PATCH 2/2] scope down: drop woodpecker-ci and openbao egress, already covered elsewhere MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PR #235 (fix/issue-193-woodpecker-ci-hardening) already adds kubernetes/infrastructure/network-policies/woodpecker-ci-ns.yaml, with a deliberately different (and better-informed) egress design: default-allow, because a past attempt at egress enforcement in this namespace broke crowdsec (66dbe9f) — history this branch didn't have context on. PR #231 (fix/issue-202-openbao-hardening) already adds an egress block to openbao-ns.yaml as part of a broader OpenBao hardening pass, including a "world" allowance (OIDC) this branch's version omitted. Dropping both here to avoid shipping a conflicting/duplicate policy; external-secrets-ns.yaml (this issue's third gap, not covered by any other open PR) is the only change left on this branch. Co-Authored-By: Claude Bot --- .../network-policies/kustomization.yaml | 1 - .../network-policies/openbao-ns.yaml | 23 --- .../network-policies/woodpecker-ci-ns.yaml | 159 ------------------ 3 files changed, 183 deletions(-) delete mode 100644 kubernetes/infrastructure/network-policies/woodpecker-ci-ns.yaml diff --git a/kubernetes/infrastructure/network-policies/kustomization.yaml b/kubernetes/infrastructure/network-policies/kustomization.yaml index 372bc827..e03f25d8 100644 --- a/kubernetes/infrastructure/network-policies/kustomization.yaml +++ b/kubernetes/infrastructure/network-policies/kustomization.yaml @@ -20,5 +20,4 @@ resources: - evcc-ns.yaml - openbao-ns.yaml - external-secrets-ns.yaml - - woodpecker-ci-ns.yaml - allow-cilium-health.yaml diff --git a/kubernetes/infrastructure/network-policies/openbao-ns.yaml b/kubernetes/infrastructure/network-policies/openbao-ns.yaml index a3fb0ff2..6be5d826 100644 --- a/kubernetes/infrastructure/network-policies/openbao-ns.yaml +++ b/kubernetes/infrastructure/network-policies/openbao-ns.yaml @@ -31,26 +31,3 @@ spec: - ports: - port: "8200" protocol: TCP - # This namespace was ingress-only (no egress block), which — per Cilium's - # semantics — means egress from openbao pods is entirely unenforced, not - # merely permissive. Adding an explicit egress block turns on enforcement - # and scopes it to what OpenBao itself actually needs. - egress: - - toEndpoints: - - matchLabels: - "k8s:io.kubernetes.pod.namespace": openbao - # DNS resolution. - - toEndpoints: - - matchLabels: - "k8s:io.kubernetes.pod.namespace": kube-system - k8s-app: kube-dns - toPorts: - - ports: - - port: "53" - protocol: UDP - # host/remote-node: kubelet probes + kube-apiserver (Kubernetes auth - # method token review, leader-election Lease, raft-snapshot CronJob's - # own apiserver calls). - - toEntities: - - host - - remote-node diff --git a/kubernetes/infrastructure/network-policies/woodpecker-ci-ns.yaml b/kubernetes/infrastructure/network-policies/woodpecker-ci-ns.yaml deleted file mode 100644 index 0b6c29f4..00000000 --- a/kubernetes/infrastructure/network-policies/woodpecker-ci-ns.yaml +++ /dev/null @@ -1,159 +0,0 @@ -# woodpecker-ci hosts no static workloads — the woodpecker-agent (apps -# namespace) dynamically creates one pod per pipeline step (kubernetes -# backend, kubernetes/apps/woodpecker/agent.yaml). Image-build steps run -# privileged (WOODPECKER_PLUGINS_PRIVILEGED), so this namespace is -# attacker-influenceable: pipeline definitions (.woodpecker.yaml) choose -# the step images and commands. This CNP's job is to stop lateral movement -# into unrelated in-cluster namespaces (openbao, home-assistant, monitoring, -# …) while still letting a build clone its repo, resolve DNS, and pull -# images/packages from the internet — the things every CI step legitimately -# needs. -apiVersion: cilium.io/v2 -kind: CiliumNetworkPolicy -metadata: - name: default-deny-ingress - namespace: woodpecker-ci -spec: - endpointSelector: {} - ingress: - # Intra-namespace — a pipeline's "service" containers (e.g. a postgres - # service backing an integration test, see rbac.yaml's services verb) - # are reached by sibling step pods over the pod network. - - fromEndpoints: - - matchLabels: - "k8s:io.kubernetes.pod.namespace": woodpecker-ci - # kubelet: exec/attach + `pods/log` streaming (the agent's log-tail - # RPC goes through kube-apiserver -> kubelet, not pod-to-pod). - - fromEntities: - - host - - remote-node - # ICMP — all standard ICMPv4 + ICMPv6 from any cluster pod. See - # home-assistant-ns.yaml for the rationale. - - fromEndpoints: - - matchExpressions: - - key: io.kubernetes.pod.namespace - operator: Exists - icmps: - - fields: - - { type: 0, family: IPv4 } - - { type: 3, family: IPv4 } - - { type: 4, family: IPv4 } - - { type: 5, family: IPv4 } - - { type: 8, family: IPv4 } - - { type: 9, family: IPv4 } - - { type: 10, family: IPv4 } - - { type: 11, family: IPv4 } - - { type: 12, family: IPv4 } - - { type: 13, family: IPv4 } - - { type: 14, family: IPv4 } - - { type: 15, family: IPv4 } - - { type: 16, family: IPv4 } - - { type: 17, family: IPv4 } - - { type: 18, family: IPv4 } - - { type: 30, family: IPv4 } - - { type: 1, family: IPv6 } - - { type: 2, family: IPv6 } - - { type: 3, family: IPv6 } - - { type: 4, family: IPv6 } - - { type: 128, family: IPv6 } - - { type: 129, family: IPv6 } - - { type: 130, family: IPv6 } - - { type: 131, family: IPv6 } - - { type: 132, family: IPv6 } - - { type: 133, family: IPv6 } - - { type: 134, family: IPv6 } - - { type: 135, family: IPv6 } - - { type: 136, family: IPv6 } - - { type: 137, family: IPv6 } - - { type: 138, family: IPv6 } - - { type: 141, family: IPv6 } - - { type: 142, family: IPv6 } - - { type: 143, family: IPv6 } - - { type: 148, family: IPv6 } - - { type: 149, family: IPv6 } - - { type: 151, family: IPv6 } - - { type: 152, family: IPv6 } - - { type: 153, family: IPv6 } - egress: - - toEndpoints: - - matchLabels: - "k8s:io.kubernetes.pod.namespace": woodpecker-ci - # DNS resolution. - - toEndpoints: - - matchLabels: - "k8s:io.kubernetes.pod.namespace": kube-system - k8s-app: kube-dns - toPorts: - - ports: - - port: "53" - protocol: UDP - # gitea.renner.uno has an in-cluster Ingress (kubernetes/apps/gitea/ - # ingress.yaml), so k8s_gateway resolves it to the Traefik LB and the - # clone step's git fetch stays east-west via traefik instead of - # hairpinning through the WAN. Matches netbird-ingress-egress.yaml's - # traefik port scoping. - - toEndpoints: - - matchLabels: - "k8s:io.kubernetes.pod.namespace": ingress - app.kubernetes.io/name: traefik - toPorts: - - ports: - - port: "8443" - protocol: TCP - # host/remote-node: kubelet. world: this is the deliberately broad rule - # — build steps need arbitrary internet reach for package managers and - # container-image pulls (docker/buildx, npm, pip, apk, …), same as - # every other namespace's image-pull/telemetry "world" grant (see - # spegel-ns.yaml, evcc-ns.yaml). The security value of this CNP is not - # restricting *that*; it's that east-west reach into unrelated - # namespaces (openbao, home-assistant, monitoring, …) stays denied. - - toEntities: - - host - - remote-node - - world - # ICMP — egress mirror; see ingress block above. - - toEndpoints: - - matchExpressions: - - key: io.kubernetes.pod.namespace - operator: Exists - icmps: - - fields: - - { type: 0, family: IPv4 } - - { type: 3, family: IPv4 } - - { type: 4, family: IPv4 } - - { type: 5, family: IPv4 } - - { type: 8, family: IPv4 } - - { type: 9, family: IPv4 } - - { type: 10, family: IPv4 } - - { type: 11, family: IPv4 } - - { type: 12, family: IPv4 } - - { type: 13, family: IPv4 } - - { type: 14, family: IPv4 } - - { type: 15, family: IPv4 } - - { type: 16, family: IPv4 } - - { type: 17, family: IPv4 } - - { type: 18, family: IPv4 } - - { type: 30, family: IPv4 } - - { type: 1, family: IPv6 } - - { type: 2, family: IPv6 } - - { type: 3, family: IPv6 } - - { type: 4, family: IPv6 } - - { type: 128, family: IPv6 } - - { type: 129, family: IPv6 } - - { type: 130, family: IPv6 } - - { type: 131, family: IPv6 } - - { type: 132, family: IPv6 } - - { type: 133, family: IPv6 } - - { type: 134, family: IPv6 } - - { type: 135, family: IPv6 } - - { type: 136, family: IPv6 } - - { type: 137, family: IPv6 } - - { type: 138, family: IPv6 } - - { type: 141, family: IPv6 } - - { type: 142, family: IPv6 } - - { type: 143, family: IPv6 } - - { type: 148, family: IPv6 } - - { type: 149, family: IPv6 } - - { type: 151, family: IPv6 } - - { type: 152, family: IPv6 } - - { type: 153, family: IPv6 } -- 2.54.0