RPKI Validation Software Security

11/12/2021

This post details the discovery and remediation of several vulnerabilities in OctoRPKI, a component of Cloudflare's RPKI toolkit used for BGP route validation. The vulnerabilities, disclosed by researchers from the University of Twente, included arbitrary file writes (CVE-2021-3907) due to path traversal in URIs, and crashes or uncontrolled resource consumption (CVE-2021-3908, CVE-2021-3909, CVE-2021-3910, CVE-2021-3911, CVE-2021-3912) caused by issues like infinite certificate chain depth, infinite open connections, NUL characters in ROA files, misconfigured IP address fields, and GZIP bombs. Cloudflare released OctoRPKI v1.4.0 with mitigations including URI filtering to prevent directory traversal and bounds checking to handle malformed inputs, ensuring the software fails closed or reports errors gracefully.

11/6/2020

This post provides an update on the progress of RPKI adoption, noting the passing of the 200,000 ROA milestone and the significant increase in networks performing BGP Origin Validation, partly driven by the launch of isbgpsafeyet.com. It details the growth of ROA creation rates and the increasing adoption of RPKI by major transit providers. The post also highlights Cloudflare's contributions to the RPKI ecosystem, including updates to its open-source OctoRPKI validator and GoRTR, and the continued usage of its public rpki.json endpoint and RPKI dashboard. It forecasts critical mass for RPKI adoption in late 2021.

4/17/2020

This post announces the launch of isBGPSafeYet.com, a website to track RPKI deployments and filtering of invalid routes by major networks. It also details the release of two RPKI-invalid prefixes (103.21.244.0/24 and 2606:4700:7000::/48) for testing purposes and presents a Hilbert curve map visualizing the extent of RPKI invalid prefix filtering across the IPv4 address space.

3/3/2020

This post details the Resource Public Key Infrastructure (RPKI) to Router Protocol (RTR), explaining its role in communicating validated route information from RPKI validators to internet routers. It discusses RFC 8210, the lightweight nature of RTR, its separation from cryptographic processing, and various transport options (TCP, SSHv2, TLS). Cloudflare's open-source contributions, OctoRPKI and GoRTR, are highlighted, along with the release of a Python-based `rpki-rtr-client` for testing and debugging.

2/24/2019

This post details Cloudflare's development and open-sourcing of two key RPKI tooling components: GoRTR and OctoRPKI. GoRTR is a Go application designed to fetch validated ROAs and serve them to RPKI-enabled routers via the RTR protocol, with features for caching and Prometheus metrics. OctoRPKI is a Go-based RPKI Relying Party validator that supports RRDP and rsync synchronization, offering an API for results and Prometheus metrics. The post explains the motivation for building these tools, the technical architecture, and provides Docker deployment instructions for both.

9/19/2018

This post details Cloudflare's initial deployment of RPKI for route origin validation and active filtering. It introduces the concept of RPKI, explains its role in securing BGP, and outlines Cloudflare's strategy for signing prefixes and enforcing validated routes. The post also introduces GoRTR, a lightweight local RTR server for secure RPKI cache distribution, and Cirrus, a Certificate Transparency Log for tracking RPKI certificates. It discusses the importance of monitoring route leaks and the current state of RPKI adoption.

9/19/2018

This post introduces Cloudflare's commitment to RPKI (Resource Public Key Infrastructure) as a cryptographic upgrade to BGP routing to combat route leaks and hijacks. It explains the basics of BGP, ASNs, CIDRs, and the role of IRR. It then details RPKI's function in signing route announcements to associate them with the correct originating AS number, contrasting it with the less secure IRR system. The post outlines the need for RPKI to secure route origins and mentions future work on securing the path. It provides a simplified introduction to BGP and the necessary IRR/RPKI setup for a hypothetical university network.