The global routing system of the internet consists of a number of
functionally independent actors (Autonomous Systems) which use BGP
(Border Gateway Protocol) to exchange routing information. The system is
very dynamic and flexible by design. Connectivity and routing topologies
are subject to change. Changes easily propagate globally within a few
minutes. One weakness of this system is that these changes cannot be
validated against information existing outside of the BGP protocol
itself.
RPKI is a way to define data in an out-of-band system such that the
information that is exchanged by BGP can be validated to be correct.
RPKI allows holders of internet number resources to make verifiable
statements about how they intend to use their resources. To achieve
this, it uses a public key infrastructure that creates a chain of
resource certificates that follows the same structure as the way IP
addresses and AS numbers are handed down.
In order to satisfy those requirements, rpki-client has:
- A simple and easily understandable codebase and commit history.
- Coninually adapts to the latest best coding practices from OpenBSD.
- Separation of privileges across multiple subprocesses combined with
pledge(2)
to restrict the use of the kernel API used by the processes.
- A distinct & restricted view of the filesystem for each subprocess
using unveil(2)
or landlock.
- Inter-process communication handled through libutil's
ibuf(3)
safe buffer and file descriptor passing API.
- A multithreaded approach to signed object validation using
pthreads.
- An embedded asynchronous I/O HTTP client based on
libtls with support
for compressed content coding and conditional requests.
- An optimized rsync data transfer strategy based on
RFC 9589.
- Automatic detection and remediation for desynchronised RRDP sessions
based on RFC 9697.
- An integrated filemode
debugging utility capable of emitting both human-readable and JSON output.
- Process run metrics exposition in OpenMetrics 1.0 format.
- The capability to detect non-functional CAs and automatically decrease
the synchronization frequency for persistently non-functional CAs.
- A set of advanced RPKI-specific denial-of-service mitigations, including:
- prioritisation of confirmed ('known good') certification paths
- randomized tree traversal
- time- and size-boxing for untrusted network inputs
- topological consistency verification
- Various forms of replay detection and mitigation.
- Support for modern RPKI RFCs, see the
STANDARDS
section for a full overview.