BSDSec

deadsimple BSD Security Advisories and Announcements

rpki-client 7.9 released

rpki-client 7.9 has just been released and will be available in the
rpki-client directory of any OpenBSD mirror soon.

rpki-client is a FREE, easy-to-use implementation of the Resource
Public Key Infrastructure (RPKI) for Relying Parties (RP) to
facilitate validation of BGP announcements. The program queries the
global RPKI repository system and validates untrusted network inputs.
The program outputs validated ROA payloads and BGPsec Router
keys in configuration formats suitable for OpenBGPD and BIRD, and
supports emitting CSV and JSON for consumption by other routing stacks.

See RFC 6480 and RFC 6811 for a description of how RPKI and BGP Prefix
Origin Validation help secure the global Internet routing system.

rpki-client was primarily developed by Kristaps Dzonsons, Claudio
Jeker, Job Snijders, Theo Buehler, Theo de Raadt and Sebastian Benoit
as part of the OpenBSD Project.

This release includes the following changes to the previous release:

- Add support for an operator-configurable skiplist facility. Operators
  can specify a list of FQDNs which should not be contacted when
  synchronizing the local cache to the network.

- Emit a warning when a RRDP session serial number decreases.

- DER decoding functions were refactored to leverage ASN.1 templates.

- Add support to validate & inspect .sig files containing RPKI Signed
  Checklists in filemode (-f). (draft-ietf-sidrops-rpki-rsc-08)

- Print various statistics after the completion of the main process.

- Add support to decode & print TAL (RFC 8630) details in filemode (-f).

- Emit objects in Concatenated JSON format when filemode (-f) and the JSON
  output flag (-j) are combined.

rpki-client works on all operating systems with a libcrypto library
based on OpenSSL 1.1 or LibreSSL 3.5, and a libtls library compatible
with LibreSSL 3.5 or later.

rpki-client is known to compile and run on at least the following
operating systems: Alpine, CentOS, Debian, Fedora, FreeBSD, Red Hat,
Rocky, Ubuntu, macOS, and of course OpenBSD!

It is our hope that packagers take interest and help adapt
rpki-client-portable to more distributions.

The mirrors where rpki-client can be found are on
https://www.rpki-client.org/portable.html

Reporting Bugs:
===============

General bugs may be reported to tech@openbsd.org

Portable bugs may be filed at
https://github.com/rpki-client/rpki-client-portable

We welcome feedback and improvements from the broader community.
Thanks to all of the contributors who helped make this release
possible.

Assistance to coordinate security issues is available via
security@openbsd.org.