Hi Nathalie, 

Thank you for addressing this RIPE NCC infra issue. 

It looks like the RIPE NCC RPKI infra for rsync is updating the ROA’s in the same directory while the RPKI clients that use rsync, are still fetching the files.

This is common knowledge on using rsync  .. but with the use of MD5 of crypto checks on the files, that becomes an issue. 

It is best practise to dump the files in a specific (timestamp)directory .. symlink the download link to the timestamp directory ..  and keep things read-only once the stuff is written on disk.. so there are no improper updates that would cause crypto or MD5 hash issues.

Once there is new RPKI data, create a new timestamp dir, move the symlink to the new location and be done with it.

As a RPKI-client user that is happy with the security within the software, that starts to barf over improper RPKI data .. as one should hope it would ..  I would like to ask the NCC to update their rsync method quicker than ‘perhaps in 6 months … ‘ 

This looks to be a 3 line bash script fix on a cronjob …  So why isn’t this just tested on a testbed and updated before the end of the week ?

Regards,

Erik Bais

From: routing-wg <routing-wg-bounces@ripe.net> on behalf of Nathalie Trenaman <nathalie@ripe.net>
Date: Monday 12 April 2021 at 12:04
To: "routing-wg@ripe.net" <routing-wg@ripe.net>
Subject: [routing-wg] Issue affecting rsync RPKI repository fetching

Dear colleagues,

We have been made aware of an issue that may affect some users who use RPKI relying party (RP) software that uses rsync. Please note that by default, only rpki-client reads from rsync; the rest of the RPs prefer the RPKI Repository Delta Protocol (RRDP). 

The issue appears to create some inconsistency between the RPKI repository and rsync clients. In more detail, an RRDP client reads a complete state for a specific “serial” from the repository. In contrast, an rsync client syncs the state in multiple steps. First, a list of files is copied, followed by updates for files that have been copied. In an affected scenario, a certificate is added and one of the other files (the manifest) is modified after the file list has been sent. By reading the new manifest, but not copying the new file (it is not on the rsync file list), the repository copied by the rsync client contains an invalid manifest (a file is missing) and the RP software rejects it.

We are planning on changing our publication infrastructure and using the same "revisions" RRDP uses for the content of the rsync repository. Rsync is an officially supported distribution protocol for RPKI repository data, and it is one of our highest priorities that the data published is atomic and consistent. We plan to release the new publication infrastructure in Q2/Q3 2021. Part of this work will mitigate these non-repeatable-reads for clients using rsync.

We will update you on our progress during RIPE 82, taking place online from 17-21 May 2021.

Kind regards,

Nathalie Trenaman

RIPE NCC