Skip to content
Snippets Groups Projects

Sanitize noncanonical IPv4 split routes

Closed Daniel Lenski requested to merge sanitize_noncanonical_IPv4_splits into master

Fix IPv4 split-{in,ex}clude routes with misspecified host bits

Some VPN platforms (GlobalProtect, apparently) allow administrators to input such non-canonical IPv4 routes, and some routing configuration utilities (apparently not iproute2) simply do not accept such non-canonical IPv4 routes.

An example of the confusion this can cause: https://lists.infradead.org/pipermail/openconnect-devel/2020-April/005665.html

The robustness principle suggests that the best thing to do here is to fix these routes, but complain about them while we're at it, e.g.:

WARNING: Split include "10.12.34.56/8" has host bits set, replacing with "10.0.0.0/8"
Edited by Daniel Lenski

Merge request reports

Loading
Loading

Activity

Filter activity
  • Approvals
  • Assignees & reviewers
  • Comments (from bots)
  • Comments (from users)
  • Commits & branches
  • Edits
  • Labels
  • Lock status
  • Mentions
  • Merge request status
  • Tracking
Please register or sign in to reply
Loading