I am trying to ivestigate a bug where a particular piece of software loses [u]--allow-pull-fqdn[/u] flag and it causes problems, so my question is: are there any reasons not to always enable it on client side? In other words, what are the cons of [u]allow-pull-fqdn[/u] option other than compatibility with older versions (that didn't support this option at the time)? All my gueses are around posible DNS leakage/harhening in one form or another, but if client accepts pushed routes then it's a smaller problem than not trusting what server would actually send.

Reason not to --allow-pull-fqdn?

LDVSoft

I am trying to ivestigate a bug where a particular piece of software loses --allow-pull-fqdn flag and it causes problems, so my question is: are there any reasons not to always enable it on client side? In other words, what are the cons of allow-pull-fqdn option other than compatibility with older versions (that didn't support this option at the time)?

All my gueses are around posible DNS leakage/harhening in one form or another, but if client accepts pushed routes then it's a smaller problem than not trusting what server would actually send.

TinCanTech

It is a commonly accepted fact that using DNS names to configure routing elements is a security risk and generally a bad idea.