Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enable RFC 9234 route leak prevention in backwards compatible ('non-strict' mode) #908

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

job
Copy link

@job job commented Sep 2, 2024

  • Requires BIRD 2.0.15 or higher

[NF] New feature summary

Enable RFC 9234 support on IXP-manager-managed route servers. See https://mailman.nanog.org/pipermail/nanog/2024-September/226204.html

In addition to the above, I have:

  • ensured all relevant template output is escaped to avoid XSS attached with <?= $t->ee( $data ) ?> or equivalent.
  • ensured appropriate checks against user privilege / resources accessed
  • API calls (particular for add/edit/delete/toggle) are not implemented with GET and use CSRF tokens to avoid CSRF attacks

@benjojo
Copy link

benjojo commented Sep 2, 2024

Requires BIRD 2.0.15 or higher

As far as I understand IXP Manager does not have a way of knowing what minor version of bird is running, and given that the current distros that I would consider most users of IXP-Manager to be using are not that new, merging this would break most configs as of right now.

@job
Copy link
Author

job commented Sep 2, 2024

thanks @benjojo

Related, perhaps 2.0.14 also is acceptable; as it contains an important bugfix

@nickhilliard
Copy link
Member

this would need to be presented in the UI with a tickbox (default: enabled).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants