rpki-client stricter aging policy for Trust Anchor certificates commited to -current

Today Job Snijders (job@) commited code to rpki-client(8) to implement a gradual phase in of a stricter policy on TA certificates lifetimes.

The commit message reads,

Subject:    CVS: cvs.openbsd.org: src
From:       Job Snijders <job () cvs ! openbsd ! org>
Date:       2024-12-18 16:38:40


CVSROOT:	/cvs
Module name:	src
Changes by:	job@cvs.openbsd.org	2024/12/18 09:38:40

Modified files:
	usr.sbin/rpki-client: cert.c 

Log message:
Schedule future rejection of ultra long-lived TA certificates

The RPKI ecosystem suffers from a partially unmitigated risk related to
long-lived Trust Anchor certificate issuances.

Read more…

FRAME sockets added to OpenBSD

Thanks to work by David Gwynne (dlg@), OpenBSD -current now has a new "AF_FRAME" socket domain:

CVSROOT:	/cvs
Module name:	src
Changes by:	dlg@cvs.openbsd.org	2024/12/15 04:00:05

Modified files:
	sys/conf       : files 
	sys/kern       : uipc_domain.c uipc_socket.c 
	sys/net        : if_ethersubr.c 
	sys/sys        : socket.h 
Added files:
	sys/net        : af_frame.c frame.h 

Log message:
add an AF_FRAME socket domain and an IFT_ETHER protocol family under it.

this allows userland to use sockets to send and receive Ethernet
frames. as per the upcoming frame.4 man page:

frame protocol family sockets are designed as an alternative to bpf(4)
for handling low data and packet rate communication protocols.  Rather
than filtering every frame entering the system before the network stack
like bpf(4), the frame protocol family processing avoids this overhead by
running after the built in protocol handlers in the kernel.  For this
reason, it is not possible to handle IPv4 or IPv6 packets with frame
protocol sockets because the kernel network stack consumes them before
the receive handling for frame sockets is run.

if you've used udp sockets then these should feel much the same.

my main motivation is to implement an lldp agent in userland, but
without having to have bpf look at every packet when lldp happens
every minute or two.

the only feedback i had was positive, so i'm putting it in
ok claudio@

There's been a related change to aggr(4).

OpenBGPD 8.7 released

Claudio Jeker (claudio@) announced the release of version 8.7 of OpenBGPD, the OpenBSD project's Border Gateway Protocol (BGP) daemon:

We have released OpenBGPD 8.7, which will be arriving in the
OpenBGPD directory of your local OpenBSD mirror soon.

This release includes the following changes to the previous release:

    * Cache the Adj-RIB-Out for sessions that have not been down for
      more than 1h. This significantly improves synchronisation time
      of peers that flap.

    * Implement RFC 8538: Notification Message Support for
      BGP Graceful Restart.

    * Add support for RFC 8654, extended messages.

    * In bgplgd add additional endpoints to query the Adj-RIB-In and
      Adj-RIB-Out.

    * Bump internal message size limit to 128k and handle up to 10 000
      ASPA SPAS entries as suggested in draft-ietf-sidrops-aspa-profile.

    * Various improvements to the ibuf API including a new reader API
      which is used to make all message parsing in bgpd memory safe.

    * Added support for IPsec and TCP MD5 to RTR sessions.

OpenBGPD-portable is known to compile and run on FreeBSD, NetBSD and the
Linux distributions Alpine, Debian, CentOS/RHEL/Rocky, Fedora, openSUSE/SLE,
and Ubuntu. It is our hope that packagers take interest and help adapt
OpenBGPD-portable to more distributions.

We welcome feedback and improvements from the broader community.
Thanks to all of the contributors who helped make this release
possible.