From 9463abd53ee24d56be2e4861b05f024ca5694a74 Mon Sep 17 00:00:00 2001 From: tb Date: Fri, 1 Mar 2024 08:10:09 +0000 Subject: [PATCH] Add -x to opt into experimental file formats Instead of burning one letter for each new file format (sidrops is known to crank out new things faster than a normal person can read), use -x to opt into parsing and processing file formats that aren't yet considered stable. This is currently only the Signed Prefix List. While a repetition of the ASPA debacle, this code hasn't yet seen enough stress testing to be enabled by default. ok claudio job --- usr.sbin/rpki-client/main.c | 13 +++++++++---- usr.sbin/rpki-client/output-json.c | 7 +++++-- usr.sbin/rpki-client/parser.c | 16 ++++++++++++---- usr.sbin/rpki-client/rpki-client.8 | 10 +++++++--- 4 files changed, 33 insertions(+), 13 deletions(-) diff --git a/usr.sbin/rpki-client/main.c b/usr.sbin/rpki-client/main.c index 231ddd821e7..8426c222bc1 100644 --- a/usr.sbin/rpki-client/main.c +++ b/usr.sbin/rpki-client/main.c @@ -1,4 +1,4 @@ -/* $OpenBSD: main.c,v 1.252 2024/02/26 15:40:33 job Exp $ */ +/* $OpenBSD: main.c,v 1.253 2024/03/01 08:10:09 tb Exp $ */ /* * Copyright (c) 2021 Claudio Jeker * Copyright (c) 2019 Kristaps Dzonsons @@ -72,6 +72,7 @@ int filemode; int shortlistmode; int rrdpon = 1; int repo_timeout; +int experimental; time_t deadline; /* 9999-12-31 23:59:59 UTC */ @@ -671,7 +672,8 @@ entity_process(struct ibuf *b, struct stats *st, struct vrp_tree *tree, case RTYPE_SPL: io_read_buf(b, &c, sizeof(c)); if (c == 0) { - repo_stat_inc(rp, talid, type, STYPE_FAIL); + if (experimental) + repo_stat_inc(rp, talid, type, STYPE_FAIL); break; } spl = spl_read(b); @@ -998,7 +1000,7 @@ main(int argc, char *argv[]) "proc exec unveil", NULL) == -1) err(1, "pledge"); - while ((c = getopt(argc, argv, "Ab:Bcd:e:fH:jmnoP:rRs:S:t:T:vV")) != -1) + while ((c = getopt(argc, argv, "Ab:Bcd:e:fH:jmnoP:rRs:S:t:T:vVx")) != -1) switch (c) { case 'A': excludeaspa = 1; @@ -1076,6 +1078,9 @@ main(int argc, char *argv[]) case 'V': fprintf(stderr, "rpki-client %s\n", RPKI_VERSION); return 0; + case 'x': + experimental = 1; + break; default: goto usage; } @@ -1509,7 +1514,7 @@ main(int argc, char *argv[]) usage: fprintf(stderr, - "usage: rpki-client [-ABcjmnoRrVv] [-b sourceaddr] [-d cachedir]" + "usage: rpki-client [-ABcjmnoRrVvx] [-b sourceaddr] [-d cachedir]" " [-e rsync_prog]\n" " [-H fqdn] [-P epoch] [-S skiplist] [-s timeout]" " [-T table]\n" diff --git a/usr.sbin/rpki-client/output-json.c b/usr.sbin/rpki-client/output-json.c index bd4c82e110f..fd371963018 100644 --- a/usr.sbin/rpki-client/output-json.c +++ b/usr.sbin/rpki-client/output-json.c @@ -1,4 +1,4 @@ -/* $OpenBSD: output-json.c,v 1.45 2024/03/01 07:59:20 tb Exp $ */ +/* $OpenBSD: output-json.c,v 1.46 2024/03/01 08:10:09 tb Exp $ */ /* * Copyright (c) 2019 Claudio Jeker * @@ -23,6 +23,8 @@ #include "extern.h" #include "json.h" +extern int experimental; + static void outputheader_json(struct stats *st) { @@ -178,7 +180,8 @@ output_json(FILE *out, struct vrp_tree *vrps, struct brk_tree *brks, if (!excludeaspa) output_aspa(vaps); - output_spl(vsps); + if (experimental) + output_spl(vsps); return json_do_finish(); } diff --git a/usr.sbin/rpki-client/parser.c b/usr.sbin/rpki-client/parser.c index 62ebcade65e..6bb52a6a7f7 100644 --- a/usr.sbin/rpki-client/parser.c +++ b/usr.sbin/rpki-client/parser.c @@ -1,4 +1,4 @@ -/* $OpenBSD: parser.c,v 1.129 2024/02/22 12:49:42 job Exp $ */ +/* $OpenBSD: parser.c,v 1.130 2024/03/01 08:10:09 tb Exp $ */ /* * Copyright (c) 2019 Claudio Jeker * Copyright (c) 2019 Kristaps Dzonsons @@ -39,6 +39,8 @@ #include "extern.h" extern int noop; +extern int experimental; +extern int verbose; static X509_STORE_CTX *ctx; static struct auth_tree auths = RB_INITIALIZER(&auths); @@ -861,9 +863,15 @@ parse_entity(struct entityq *q, struct msgbuf *msgq) case RTYPE_SPL: file = parse_load_file(entp, &f, &flen); io_str_buffer(b, file); - spl = proc_parser_spl(file, f, flen, entp); - if (spl != NULL) - mtime = spl->signtime; + if (experimental) { + spl = proc_parser_spl(file, f, flen, entp); + if (spl != NULL) + mtime = spl->signtime; + } else { + if (verbose > 0) + warnx("%s: skipped", file); + spl = NULL; + } io_simple_buffer(b, &mtime, sizeof(mtime)); c = (spl != NULL); io_simple_buffer(b, &c, sizeof(int)); diff --git a/usr.sbin/rpki-client/rpki-client.8 b/usr.sbin/rpki-client/rpki-client.8 index 057eff62d2e..15708529df7 100644 --- a/usr.sbin/rpki-client/rpki-client.8 +++ b/usr.sbin/rpki-client/rpki-client.8 @@ -1,4 +1,4 @@ -.\" $OpenBSD: rpki-client.8,v 1.102 2024/02/22 17:54:08 tb Exp $ +.\" $OpenBSD: rpki-client.8,v 1.103 2024/03/01 08:10:09 tb Exp $ .\" .\" Copyright (c) 2019 Kristaps Dzonsons .\" @@ -14,7 +14,7 @@ .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" -.Dd $Mdocdate: February 22 2024 $ +.Dd $Mdocdate: March 1 2024 $ .Dt RPKI-CLIENT 8 .Os .Sh NAME @@ -22,7 +22,7 @@ .Nd RPKI validator to support BGP routing security .Sh SYNOPSIS .Nm -.Op Fl ABcjmnoRrVv +.Op Fl ABcjmnoRrVvx .Op Fl b Ar sourceaddr .Op Fl d Ar cachedir .Op Fl e Ar rsync_prog @@ -231,6 +231,10 @@ If .Fl f is given, specify once to print more information about the encapsulated X.509 certificate, twice to print the certificate in PEM format. +.It Fl x +Enable processing of experimental file formats. +This option is implied by +.Fl f . .It Ar outputdir The directory where .Nm -- 2.20.1