rpki-client Features

The global routing system of the internet consists of a number of functionally independent actors (Autonomous Systems) which use BGP (Border Gateway Protocol) to exchange routing information. The system is very dynamic and flexible by design. Connectivity and routing topologies are subject to change. Changes easily propagate globally within a few minutes. One weakness of this system is that these changes cannot be validated against information existing outside of the BGP protocol itself. RPKI is a way to define data in an out-of-band system such that the information that is exchanged by BGP can be validated to be correct. RPKI allows holders of internet number resources to make verifiable statements about how they intend to use their resources. To achieve this, it uses a public key infrastructure that creates a chain of resource certificates that follows the same structure as the way IP addresses and AS numbers are handed down.

In order to satisfy those requirements, rpki-client has:

• A simple and easily understandable codebase.
• Privilege separation combined with pledge(2) to restrict the use of kernel API used by the processes.
• Integrates the latest secure API advances from OpenBSD such as reallocarray(3) (an integer overflow-checking malloc/calloc/realloc replacement) and explicit_bzero(3) (clear memory that will not be removed by a compiler's dead store optimization).