RPKI Validation Software Security

7 posts · Sep 2018 – Nov 2021

What this trail covers

Cloudflare is actively involved in securing RPKI validation software, addressing vulnerabilities in implementations like OctoRPKI. This includes developing and releasing patches for issues such as arbitrary file writes and resource consumption attacks, contributing to the overall security and reliability of BGP route validation. The post highlights the passing of the two hundred thousand ROA threshold, the launch of isbgpsafeyet.com, and the growth of RPKI Origin Validation deployment across net

All Cloudflare trails

Nov 2021Fixing Recent Validation Vulnerabilities in OctoRPKIThis post details the discovery and remediation of several vulnerabilities in OctoRPKI, including arbitrary file writes via path traversal (CVE-2021-3907) and issues leading to crashes or uncontrolled resource consumption (CVE-2021-3908, CVE-2021-3909, CVE-2021-3910, CVE-2021-3911, CVE-2021-3912). Mitigations include filtering URIs to prevent directory traversal and implementing bounds checking to handle malformed inputs, ensuring OctoRPKI fails closed or reports errors gracefully.
Nov 2020The Internet is Getting Safer: Fall 2020 RPKI UpdateThis post provides an update on RPKI adoption and Cloudflare's contributions to its ecosystem. It highlights the milestone of 200,000 ROAs, the success of the isbgpsafeyet.com website in driving RPKI Origin Validation deployment, and the increasing adoption by major transit providers. It also details the growth of ROA creation rates and the spread of RPKI Origin Validation across the IPv4 space. Cloudflare's open-source RPKI software (OctoRPKI, GoRTR) and public services (rpki.json, RPKI dashboard) are reiterated as tools to facilitate adoption. The future outlook suggests critical mass for RPKI will be reached in late 2021.
Apr 2020Is BGP Safe Yet? No. But we are tracking it carefullyThis post announces the launch of isBGPSafeYet.com, a website to track RPKI deployments and filtering of invalid routes by major networks. It also details the use of two specific invalid prefixes (103.21.244.0/24 and 2606:4700:7000::/48) for testing RPKI implementation and propagation. The post includes visualizations of RPKI deployment status and a Hilbert curve map illustrating the extent of RPKI invalid prefix filtering.
Mar 2020RPKI and the RTR protocolThis post details the Resource Public Key Infrastructure (RPKI) to Router Protocol (RTR), explaining its role in communicating validated route information from RPKI validators to internet routers. It discusses RFC 8210, the lightweight nature of RTR, its separation from cryptographic processing, and various transport options (TCP, SSHv2, TLS). Cloudflare's open-source contributions, OctoRPKI and GoRTR, are highlighted, along with the release of a Python-based `rpki-rtr-client` for testing and debugging.
Feb 2019Cloudflare’s RPKI ToolkitCloudflare has developed and open-sourced two key components for RPKI deployment: GoRTR, a Go application that fetches validated ROAs and distributes them to routers via the RTR protocol, and OctoRPKI, a Go-based RPKI Relying Party validator that supports RRDP and provides an API for results. GoRTR can be run via Docker and configured to fetch RPKI data from a URL, while OctoRPKI can also be run via Docker and provides its results via a JSON output. The company has also observed significant traffic shifts due to invalid route announcements and actively engages with network operators to correct these issues.
Advertisement
Sep 2018RPKI and BGP: our path to securing Internet RoutingThis post details Cloudflare's implementation of RPKI for securing Internet routing. It explains BGP, RPKI concepts (ROAs), Cloudflare's process of signing prefixes, and the development of GoRTR for secure distribution of RPKI validation data to routers. It also introduces Cirrus, a Certificate Transparency Log for RPKI, and discusses awareness of route leaks and future challenges.
Sep 2018RPKI - The required cryptographic upgrade to BGP routingThis post introduces Cloudflare's commitment to RPKI for securing BGP routing. It explains the problem of route leaks and hijacks, the limitations of existing IRR systems, and how RPKI provides cryptographic signing for route origin validation. The post details the basic concepts of BGP, ASNs, and IP addresses, and outlines the necessary steps for setting up IRR route objects and RPKI ROAs. It contrasts RPKI with IRR, emphasizing RPKI's cryptographic security and its role in securing route origins.