Add -x to opt into experimental file formats

Instead of burning one letter for each new file format (sidrops is known
to crank out new things faster than a normal person can read), use -x to
opt into parsing and processing file formats that aren't yet considered
stable. This is currently only the Signed Prefix List.  While a repetition
of the ASPA debacle, this code hasn't yet seen enough stress testing to be
enabled by default.

ok claudio job

diff --git a/usr.sbin/rpki-client/main.c b/usr.sbin/rpki-client/main.c
index 231ddd8..8426c22 100644 (file)
--- a/usr.sbin/rpki-client/main.c
+++ b/usr.sbin/rpki-client/main.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: main.c,v 1.252 2024/02/26 15:40:33 job Exp $ */
+/*     $OpenBSD: main.c,v 1.253 2024/03/01 08:10:09 tb Exp $ */
 /*
  * Copyright (c) 2021 Claudio Jeker <claudio@openbsd.org>
  * Copyright (c) 2019 Kristaps Dzonsons <kristaps@bsd.lv>
@@ -72,6 +72,7 @@ int   filemode;
 int    shortlistmode;
 int    rrdpon = 1;
 int    repo_timeout;
+int    experimental;
 time_t deadline;
 
 /* 9999-12-31 23:59:59 UTC */
@@ -671,7 +672,8 @@ entity_process(struct ibuf *b, struct stats *st, struct vrp_tree *tree,
        case RTYPE_SPL:
                io_read_buf(b, &c, sizeof(c));
                if (c == 0) {
-                       repo_stat_inc(rp, talid, type, STYPE_FAIL);
+                       if (experimental)
+                               repo_stat_inc(rp, talid, type, STYPE_FAIL);
                        break;
                }
                spl = spl_read(b);
@@ -998,7 +1000,7 @@ main(int argc, char *argv[])
            "proc exec unveil", NULL) == -1)
                err(1, "pledge");
 
-       while ((c = getopt(argc, argv, "Ab:Bcd:e:fH:jmnoP:rRs:S:t:T:vV")) != -1)
+       while ((c = getopt(argc, argv, "Ab:Bcd:e:fH:jmnoP:rRs:S:t:T:vVx")) != -1)
                switch (c) {
                case 'A':
                        excludeaspa = 1;
@@ -1076,6 +1078,9 @@ main(int argc, char *argv[])
                case 'V':
                        fprintf(stderr, "rpki-client %s\n", RPKI_VERSION);
                        return 0;
+               case 'x':
+                       experimental = 1;
+                       break;
                default:
                        goto usage;
                }
@@ -1509,7 +1514,7 @@ main(int argc, char *argv[])
 
 usage:
        fprintf(stderr,
-           "usage: rpki-client [-ABcjmnoRrVv] [-b sourceaddr] [-d cachedir]"
+           "usage: rpki-client [-ABcjmnoRrVvx] [-b sourceaddr] [-d cachedir]"
            " [-e rsync_prog]\n"
            "                   [-H fqdn] [-P epoch] [-S skiplist] [-s timeout]"
            " [-T table]\n"

diff --git a/usr.sbin/rpki-client/output-json.c b/usr.sbin/rpki-client/output-json.c
index bd4c82e..fd37196 100644 (file)
--- a/usr.sbin/rpki-client/output-json.c
+++ b/usr.sbin/rpki-client/output-json.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: output-json.c,v 1.45 2024/03/01 07:59:20 tb Exp $ */
+/*     $OpenBSD: output-json.c,v 1.46 2024/03/01 08:10:09 tb Exp $ */
 /*
  * Copyright (c) 2019 Claudio Jeker <claudio@openbsd.org>
  *
@@ -23,6 +23,8 @@
 #include "extern.h"
 #include "json.h"
 
+extern int experimental;
+
 static void
 outputheader_json(struct stats *st)
 {
@@ -178,7 +180,8 @@ output_json(FILE *out, struct vrp_tree *vrps, struct brk_tree *brks,
        if (!excludeaspa)
                output_aspa(vaps);
 
-       output_spl(vsps);
+       if (experimental)
+               output_spl(vsps);
 
        return json_do_finish();
 }

diff --git a/usr.sbin/rpki-client/parser.c b/usr.sbin/rpki-client/parser.c
index 62ebcad..6bb52a6 100644 (file)
--- a/usr.sbin/rpki-client/parser.c
+++ b/usr.sbin/rpki-client/parser.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: parser.c,v 1.129 2024/02/22 12:49:42 job Exp $ */
+/*     $OpenBSD: parser.c,v 1.130 2024/03/01 08:10:09 tb Exp $ */
 /*
  * Copyright (c) 2019 Claudio Jeker <claudio@openbsd.org>
  * Copyright (c) 2019 Kristaps Dzonsons <kristaps@bsd.lv>
@@ -39,6 +39,8 @@
 #include "extern.h"
 
 extern int noop;
+extern int experimental;
+extern int verbose;
 
 static X509_STORE_CTX  *ctx;
 static struct auth_tree         auths = RB_INITIALIZER(&auths);
@@ -861,9 +863,15 @@ parse_entity(struct entityq *q, struct msgbuf *msgq)
                case RTYPE_SPL:
                        file = parse_load_file(entp, &f, &flen);
                        io_str_buffer(b, file);
-                       spl = proc_parser_spl(file, f, flen, entp);
-                       if (spl != NULL)
-                               mtime = spl->signtime;
+                       if (experimental) {
+                               spl = proc_parser_spl(file, f, flen, entp);
+                               if (spl != NULL)
+                                       mtime = spl->signtime;
+                       } else {
+                               if (verbose > 0)
+                                       warnx("%s: skipped", file);
+                               spl = NULL;
+                       }
                        io_simple_buffer(b, &mtime, sizeof(mtime));
                        c = (spl != NULL);
                        io_simple_buffer(b, &c, sizeof(int));

diff --git a/usr.sbin/rpki-client/rpki-client.8 b/usr.sbin/rpki-client/rpki-client.8
index 057eff6..1570852 100644 (file)
--- a/usr.sbin/rpki-client/rpki-client.8
+++ b/usr.sbin/rpki-client/rpki-client.8
@@ -1,4 +1,4 @@
-.\"    $OpenBSD: rpki-client.8,v 1.102 2024/02/22 17:54:08 tb Exp $
+.\"    $OpenBSD: rpki-client.8,v 1.103 2024/03/01 08:10:09 tb Exp $
 .\"
 .\" Copyright (c) 2019 Kristaps Dzonsons <kristaps@bsd.lv>
 .\"
@@ -14,7 +14,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: February 22 2024 $
+.Dd $Mdocdate: March 1 2024 $
 .Dt RPKI-CLIENT 8
 .Os
 .Sh NAME
@@ -22,7 +22,7 @@
 .Nd RPKI validator to support BGP routing security
 .Sh SYNOPSIS
 .Nm
-.Op Fl ABcjmnoRrVv
+.Op Fl ABcjmnoRrVvx
 .Op Fl b Ar sourceaddr
 .Op Fl d Ar cachedir
 .Op Fl e Ar rsync_prog
@@ -231,6 +231,10 @@ If
 .Fl f
 is given, specify once to print more information about the encapsulated X.509
 certificate, twice to print the certificate in PEM format.
+.It Fl x
+Enable processing of experimental file formats.
+This option is implied by
+.Fl f .
 .It Ar outputdir
 The directory where
 .Nm