Weekly update

Week of 2026-08-10

Web and Looking Glass rewrites, remote-triggered blackholing, dynamic BGP peer repairs, authenticated PPPoE and another standards pass shaped the week.

← All weekly updates

🛰️ BGP control and route servers

New:

  • Per-peer blackhole communities and blackhole prefixes implement RFC 7999 remote-triggered blackholing. Only an agreed community from an authorized peer, inside an authorized covering prefix, becomes a discard route.
  • BGP import policies can condition a modification and remove MULTI_EXIT_DISC before route selection.

Fixed:

  • Dynamic groups inherit address families, ADD-PATH settings, filters, passwords, attached processes and plugin settings. Unchanged groups keep their live sessions across reload.
  • Re-advertised ADD-PATH routes get stable Path Identifiers owned by Ze, so clients reusing one incoming identifier no longer collapse into one downstream path.
  • RPKI reports whether each cache has completed a sync, honors its refresh interval, refuses unparseable prefixes and applies revalidation to installed routes.
  • Ze no longer advertises a route back to a peer when the final next hop is that peer's own address.

📡 Subscriber edge and network services

New:

  • PPPoE access concentrators can require pap, chap-md5 or ms-chap-v2 through auth-method. The default is chap-md5, and allow-no-auth remains false unless explicitly enabled.

Fixed:

  • EAP-TLS answers Start with ClientHello and sends the TLS 1.3 protected success indication. Mid-EAP IKE_AUTH retransmissions replay the cached response.
  • IKEv2 uses the RFC 4303 replay-window default and preserves the XFRM settings required for installed security associations.
  • Authoritative DNS distinguishes REFUSED, NXDOMAIN and NODATA, rejects non-query opcodes, and truncates only datagram replies.
  • An L2TP SCCRQ with a zero Assigned Tunnel ID now receives StopCCN.

🖥️ Web, labs and operations

New:

  • The web interface, Looking Glass and chaos dashboard now use templ components and htmx 4.0.0-beta6.
  • Ze ships a netlab daemon definition for BGP, OSPF, IS-IS, BFD and static routing. make ze-docker-lab-build builds the local lab image.

Fixed:

  • Web inline edits commit on Enter instead of every keystroke, and secret values stay masked on every rendering path.
  • Management listeners retain their configured address and authentication settings. Removed users stop authenticating after reload.
  • Daemon startup and reload apply the same registered value checks as ze config validate. Stored-config diffs include structural additions and deletions.
  • Appliance kernels include every tunnel type that Ze exposes. Mirror teardown removes Ze's filter without removing the shared traffic-control attachment.

📚 Standards program

Ze is being checked against every RFC it implements, one MUST at a time. The work has started rather than finished.

There are 3,043 MUST-level requirements. Of those, 2,965 are checked, and 51 still owe work. Six documents have been read end to end against their source text. The other 165 have not.

A green run proves everything currently written down. It does not yet prove that the list is complete, which is why the end-to-end reading continues.

What that turned up this week:

  • RFC 7999 remote-triggered blackholing had no receive path. The BGP feature above is the result.
  • Ze ignored the RFC 1997 scopes of NO_ADVERTISE, NO_EXPORT and NO_EXPORT_SUBCONFED on both forwarding paths. Withdrawals now still reach peers whose announcements are suppressed.
  • EAP-TLS did not send the RFC 9190 protected success indication, and it answered Start with an ACK instead of ClientHello. Both paths are fixed.

🔭 Coming up

The order remains: fix the defects already found, clear the 51 MUSTs that still owe work, then read the remaining 165 documents end to end. SHOULD-level work waits behind all three.