Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

have_route_to auth protection is insufficient #543

Open
jkroonza opened this issue Jan 7, 2025 · 1 comment
Open

have_route_to auth protection is insufficient #543

jkroonza opened this issue Jan 7, 2025 · 1 comment

Comments

@jkroonza
Copy link
Contributor

jkroonza commented Jan 7, 2025

in pppd/auth.c have_route_to(0) is used to check if we've got a default route prior to starting pppd, and if so, require auth.

In a future world where there is no IPv4 this is not sufficient, meaning we either need to check for (have_route_to(0) || have_route6_to(0)), or we need to not rely on this check at all.

I need to think about this in order to make a recommendation.

Further, to make matters worse, it may in theory be possible that our system depends on dynamic routing using eg OSPF/BGP to obtain a default route, but some other system may already initiated pppd, as such, I honestly think the check is shortsighted in some way or another.

No recommendation as of right now.

@Neustradamus
Copy link
Member

@paulusmack, @sthibaul, @enaess, @RICCIARDI-Adrien: @jkroonza has done this ticket.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

2 participants