[Sidrops] New validator implementation: OpenBSD's rpki-client(8)

[Job Snijders <[e-mail]>]

Dear working group,

I'm pleased to announce the publication of the liberally licensed
rpki-client! The software is usable and produces useful output, but is
still in volatile state.

The portable version (which can run on Linux and FreeBSD) is now
available via github: https://github.com/kristapsdz/rpki-client
The OpenBSD project has imported a copy of the source code into its main
development tree. It is expected to simmer there for a bit, there will
be some back and forth between the openbsd specific and -portable
version (like with other projects such as ssh and bgpd).

My hope is that we can now bring the code to sufficient high quality
level so that it can be a standard tool in the 6.6 release of the
OpenBSD operating system (November 2019)! At that point we hopefully can
point at the first Network Operating System that has a built-in BGP
daemon *and* RPKI validator. I hope is that the likes of Arrcus, Cisco,
and Juniper will take note and copy! :-)

What the software can do so far:

    - download all RPKI repositories (with openrsync)
    - validate the RPKI tree
    - output RPKI VRPs in OpenBGPD format

This may not sound like much, but getting to this stage was quite some
work. Rpki-client is a CLI tool meant to be run from something like
cron, it is not a daemon and does not support RTR. You'd probably end up
using rpki-client in combinatino with Cloudflare's GoRTR if you need
RTR.

What the future holds
=====================

1/ rpki-client depends on OpenSSL. This is fine for all non-OpenBSD
   systems, but not acceptable for an OpenBSD release. People are
   working to extend LibreSSL in such a way that it supports the CMS
   functions that rpki-client requires. Having multiple commonly used
   cryptographic libraries that can be used in context RPKI would a huge
   win for the Internet community.

2/ Adherance to coding convention & style clean up. Rpki-client has been
   handed over from its principal author Kristaps Dzonsons to the wider
   OpenBSD community. An inaugural step in this process always is to
   make the code pretty and shiny.

3/ More outputs, currently the code only supports OpenBGPD format, we
   want to add JSON (for easier integration with GoRTR) and perhaps some
   other useful formats.

4/ Porting to other operating systems. The code has been released, we
   now have to wait for package maintainers and porters to pick up the
   code and package for CentOS, Debian, FreeBSD, etc!

5/ Add support for RRDP. Rpki-client currently only supports the rsync
   protocol. In order to support the lowest common denominator across all
   RIRs, a new tool was developed as part of the rpki-client project,
   namely openrsync https://github.com/kristapsdz/openrsync/
   developing a full GNU rsync alternative took away from the time
   available to develop RRDP support, so we'll have to add that in
   later.

Let me know if you have any questions!

Kind regards,

Job