Subject: Re: [Sidrops] Example BGPSec Router certificate, and GBR for testing?

From: Job Snijders <[email-masked]>
Date: Mon, 7 Dec 2020 13:49:32 +0000

Hi Tim,

On Fri, Oct 02, 2020 at 11:24:03AM +0200, Tim Bruijnzeels wrote:
> Does anyone have a real world BGPSec router certificate and
> Ghostbuster object they could share for testing validation software?
> 
> The same applies to Ghostbuster records. If there is an example that
> could be shared, then this could help us and other RP implementers to
> deal with these objects securely as well.

I published a Ghostbusters record which you can find by via the RIPE NCC
Trust Anchor:

rsync://chloe.sobornost.net/rpki/Sobornost/m4SxTZayQtEojVOp4jrY0LmhDyw.gbr

Kind regards,

Job

---

From: Tim Bruijnzeels <[email-masked]>
Date: Mon, 7 Dec 2020 15:06:47 +0100

Hi Job,

> On 7 Dec 2020, at 14:49, Job Snijders <[email-masked]> wrote:
> 
> Hi Tim,
> 

Thanks! We noticed.

When we looked earlier it had the wrong vCard version, but it's useful to have this also in that state. My colleagues are already analysing it. We can report on it later.

Tim

---

From: Job Snijders <[email-masked]>
Date: Mon, 7 Dec 2020 17:51:05 +0000

On Mon, Dec 07, 2020 at 03:06:47PM +0100, Someone wrote:
> Thanks! We noticed.
> 
> When we looked earlier it had the wrong vCard version, but it's useful
> to have this also in that state. My colleagues are already analysing
> it. We can report on it later.

Ah, good catch. Now fixed:

    $ rsync rsync://chloe.sobornost.net/rpki/Sobornost/LMrbiOIR4bDInnBEXLsY5MZ1q1U.gbr .
    $ openssl cms -verify -noverify -in LMrbiOIR4bDInnBEXLsY5MZ1q1U.gbr -inform der
    BEGIN:VCARD
    VERSION:4.0
    ADR:;;;Amsterdam;;;The Netherlands
    EMAIL:[email-masked]
    FN:Job Snijders
    N:;;;;
    ORG:Sobornost
    TEL:+31654942365
    END:VCARD
    Verification successful

Without pointing fingers to anyone...

It appears not yet all validators are able to handle the presence of
this valid, correct, signed data gracefully... In some networks my Very
Important route is now marked as 'not-found' in BGP routers instead of
'valid'.

Any CA could at any moment start publishing .gbr files, and it seems
some validators consider all objects on the manifest to be invalid
merely because they don't (yet?) support Ghostbuster Records.

While would be beneficial if all validators implement decoding RFC 6493
objects... something worse than 'lack of support' is going on: I
currently see some RPs 'choke' on the ghostbuster record and as a result
ignore adjacent .roa files (which I consider critical for Internet
routing).

The existence of validators which don't *at least ignore* object types
that are unknown is potentially is somewhat detrimental to the
deployment of new applications based on PKIX-RPKI.

To validate the *manifest*, at a high level a validator should perform
these steps:

    1) check if the manifest's EE certificate is valid, current, not-revoked
    2) check if each file listed on the manifest is present
    3) check if the hash of each file matches the hash on the manifest
    4) process each object according to the rules for that object (if
       the object type is supported, if the object type is not supported
       ignore the object)

So in the subsequent 'per object' validation (that follows after
manifest validation), an object like this Ghostbuster Record can of
course be ignored if the implementation does not support GBR files.

In summary: I posit that lack of support for a given object type is not
a great reason to 'throw out' all objects on a valid manifest.

Kind regards,

Job