From: Ralph Covelli <rcovelli@he.net>
Subject: Re: rpki-client: change expire time for BRKs
To: tech@openbsd.org
Date: Tue, 13 Oct 2026 21:03:00 -0400

Hi,

Looks good to me.  No changes necessary on the rtrd side.

OK rcovelli@

On 10/13/2026 1:05 PM, Theo Buehler wrote:
> Currently the expire time for BRKs in rpki-client's BRK tree is the
> BGPsec Router Cert's notAfter unlike for VRPs and VAPs, where the
> signature path's expire time is used. The JSON output in file mode
> already displays the expire time of the signature path for them, which
> is inconsistent with the json output file and what rtrd receives.
> 
> This diff pushes the expire time of all certs to the main process (which
> we may want at some point) and uses this for the BRK tree. In particular,
> the expire time communicated to rtrd is more in line with the ones used
> for VRPs and VAPs.
> 
> For the two BRKs this means for a run at Tue 13 Oct 2026 16:50:00 UTC
> (a few minutes ago):
> 
> OLD: Tue 15 Jun 2027 08:09:44 +0000 (the second one has 08:09:48)
> NEW: Tue 13 Oct 2026 22:39:01 +0000
> 
> This makes all expire times lie between now and about a week from now
> rather than having two outliers expiring many months in the future.
> 
> Index: cert.c
> ===================================================================
> RCS file: /cvs/src/usr.sbin/rpki-client/cert.c,v
> diff -u -p -r1.246 cert.c
> --- cert.c	9 Oct 2026 08:36:50 -0000	1.246
> +++ cert.c	13 Oct 2026 16:26:15 -0000
> @@ -1821,6 +1821,7 @@ void
>   cert_buffer(struct ibuf *b, const struct cert *cert)
>   {
>   	io_simple_buffer(b, &cert->notafter, sizeof(cert->notafter));
> +	io_simple_buffer(b, &cert->expires, sizeof(cert->expires));
>   	io_simple_buffer(b, &cert->purpose, sizeof(cert->purpose));
>   	io_simple_buffer(b, &cert->talid, sizeof(cert->talid));
>   	io_simple_buffer(b, &cert->issuerid, sizeof(cert->issuerid));
> @@ -1877,6 +1878,7 @@ cert_read(struct ibuf *b)
>   		err(1, NULL);
>   
>   	io_read_buf(b, &cert->notafter, sizeof(cert->notafter));
> +	io_read_buf(b, &cert->expires, sizeof(cert->expires));
>   	io_read_buf(b, &cert->purpose, sizeof(cert->purpose));
>   	io_read_buf(b, &cert->talid, sizeof(cert->talid));
>   	io_read_buf(b, &cert->issuerid, sizeof(cert->issuerid));
> @@ -2043,7 +2045,7 @@ insert_brk(struct brk_tree *tree, struct
>   		err(1, NULL);
>   
>   	b->asid = asid;
> -	b->expires = cert->notafter;
> +	b->expires = cert->expires;
>   	b->talid = cert->talid;
>   	if ((b->ski = strdup(cert->ski)) == NULL)
>   		err(1, NULL);
> Index: parser.c
> ===================================================================
> RCS file: /cvs/src/usr.sbin/rpki-client/parser.c,v
> diff -u -p -r1.192 parser.c
> --- parser.c	9 Oct 2026 10:05:12 -0000	1.192
> +++ parser.c	13 Oct 2026 16:26:15 -0000
> @@ -646,6 +646,7 @@ proc_parser_cert(char *file, const unsig
>   	if (cert->purpose == CERT_PURPOSE_BGPSEC_ROUTER) {
>   		if (!constraints_validate(file, cert))
>   			goto out;
> +		cert->expires = x509_find_expires(cert->notafter, a, crl);
>   	}
>   
>   	/*
>