Refuse link-local addresses in the antispoof lists

fe80::/10 in the IPv6 antispoof list (or your prefixes) dropped the
ISP's router adverts and DHCPv6 replies in the early chain, before the
ICMPv6 and DHCPv6 client built-ins could accept them: the router lost
its IPv6 default route. Validation now refuses it
(antispoof_link_local), the settings page says so, and the importer
leaves it out with a note.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/importer/importer.go

@@ -1502,7 +1502,15 @@ func (im *importer) builtinOf(chain string, p *parsed) string {
 		}
 		set := &im.st.Settings
 		if p.family == "ipv6" {
-			set.OwnPrefixes = append(set.OwnPrefixes, p.src...)
+			for _, s := range p.src {
+				// Dropping link-local on an external zone loses the ISP's
+				// router adverts and DHCPv6 replies.
+				if a, err := model.ParseAddress(s); err == nil && a.Overlaps(model.LinkLocal6) {
+					im.note("antispoofing: %s left out: it holds link-local addresses, which the ISP's router adverts and DHCPv6 replies come from", s)
+					continue
+				}
+				set.OwnPrefixes = append(set.OwnPrefixes, s)
+			}
 			im.st.Settings.AntispoofV6 = nil
 		} else {
 			set.AntispoofV4 = p.src

internal/importer/importer_test.go

@@ -321,3 +321,26 @@ func TestImportMeters(t *testing.T) {
 		}
 	}
 }
+
+// TestImportAntispoofLinkLocal: link-local in an IPv6 antispoof drop is
+// left out (with a note), since it would drop the ISP's router adverts.
+func TestImportAntispoofLinkLocal(t *testing.T) {
+	js, _ := os.ReadFile("testdata/router.json")
+	txt, _ := os.ReadFile("testdata/router.txt")
+	defs, _ := os.ReadFile("testdata/router.nft")
+	own := `{"prefix": {"addr": "2a02:8013:7f3d::", "len": 48}}`
+	if !strings.Contains(string(js), own) {
+		t.Fatal("router.json has no own-prefix drop")
+	}
+	js = []byte(strings.Replace(string(js), own, `{"set": [`+own+`, {"prefix": {"addr": "fe80::", "len": 10}}]}`, 1))
+	res, err := Import(Input{JSON: js, Text: string(txt), Defines: string(defs)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if p := res.State.Settings.OwnPrefixes; len(p) != 1 || p[0] != "2a02:8013:7f3d::/48" {
+		t.Errorf("own prefixes %v", p)
+	}
+	if !strings.Contains(strings.Join(res.Notes, "\n"), "fe80::/10 left out") {
+		t.Errorf("no note: %q", res.Notes)
+	}
+}