Not just every implementation, but also every version, and every configuration permutation. This type of black box testing is not scalable. It is not feasible work, nor the job of these researchers. It’s the job of the software the developer to ensure the product is standards compliant.
In the case of FRR:
- improper use of the 0xFF codepoint
- FRR is not compliant with RFC 7606 (the devs indicated they will be working on this)
Ultimately, the developers are responsible for their product, not random other internet users. This situation was avoidable if standards had been followed.
I’m happy the FRR developers quickly identified the issue and published a fix. We can now all move on.
Kind regards,
Job