Subject: [Sidrops] potential errata for RFC 8182 (RRDP) - serial 0

From: Job Snijders <[email-masked]>
Date: Wed, 15 Dec 2021 14:38:22 +0100

Dear all,

I noticed there are some RRDP server implementations which produce
non-confirming XML. An example of broken RRDP (redacted) content:

    <notification xmlns="http://www.ripe.net/rpki/rrdp" version="1" session_id="1" serial="0">
       <snapshot uri="https://rpki/rrdp/1/0/snapshot.xml" hash="redacted" />
    </notification>

The problem is a value of 0 (zero) for the 'serial' attribute in the
'notification' element. According to RFC 8182 section 3.5.1.3, the value
0 in context of the serial is unambiguously invalid:

    "The serial attribute MUST be an unbounded, unsigned positive
    integer in decimal format indicating the current version of the
    repository."
    https://datatracker.ietf.org/doc/html/rfc8182#section-3.5.1.3

Furthermore, the schema in Section 3.5.4 specifies serial to be a
"xsd:positiveInteger", which is described as

    "The value space of xsd:positiveInteger includes the set of the
    strictly positive integers (excluding zero), with no restriction of
    range. Its lexical space allows any number of insignificant leading
    zeros." (src: http://books.xmlschemata.org/relaxng/ch19-77279.html)

With the above in mind, I see two paths forward:

path #1:
========
    Affected RRDP server implementations recognize this issue, fix the
    bug (by starting to count from 1 onwards); no RFC errata; no changes
    to RPs.

path #2:
========
    An errata is filed on RFC 8182; RPs update their code to take the 
    new errata into consideration (iff the Errata is accepted);
    no changes to RRDP server implementations.
    
    In the errata I'd remove the word 'positive' from section 3.5.1.3, and
    change serial to be xsd:nonNegativeInteger
    (http://books.xmlschemata.org/relaxng/ch19-77247.html) to make 0 a legal
    value.

Does the group have any preferences?

Kind regards,

Job

---

From: Ben Maddison <[email-masked]>
Date: Wed, 15 Dec 2021 15:44:24 +0200

Hi all,

On 12/15, Job Snijders wrote:
> [...]
I think this option still requires an errata to remove the word
"unsigned" from the definition.

An integer cannot simultaneously be "unsigned" and "positive".

Cheers,

Ben

---

From: Tim Bruijnzeels <[email-masked]>
Date: Wed, 15 Dec 2021 15:18:38 +0100

Hi Job, all,

> On 15 Dec 2021, at 14:38, Job Snijders <job=[email-masked]> wrote:
> 
> Dear all,
> 
> With the above in mind,

Just to add to this:

Section 3.3.1. Initialization has:

...
   o  After the Snapshot File has been published, the Repository Server
      MUST publish a new Update Notification File that contains the new
      session_id, has serial number ONE, has one reference to the
      Snapshot File that was just published...
...

> I see two paths forward:

This has my preference.

Krill has the same bug. I did not expect that starting the counting
at 0 would be harmful, so I overlooked that the specification says
that we should start at 1.

I guess I replayed things from memory, rather than text in this case.

The fix is trivial enough, and I can push one out today. But, it will
require that users upgrade - which will happen eventually. If RPs can be
forgiving for a while then this path has my preference. If they fall back
to rsync until serial 1 is published then that would be regrettable, but
still not result in an enduring issue.

>    (http://books.xmlschemata.org/relaxng/ch19-77247.html) to make 0 a legal

Less preferred by me at least. I think it will require at least one more
change (in section 3.3.1).

Also, I think the RFC is actually clear on this, but it's just easy to
overlook because one may not expect that 0 is technically not allowed.
And having an erratum may not help to improve readability.

Kind regards,
Tim

> _______________________________________________
> Sidrops mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidrops

---

From: Claudio Jeker <[email-masked]>
Date: Wed, 15 Dec 2021 15:23:08 +0100

> Does the group have any preferences?

I prefer if the faulty RRDP software is fixed. Knowing that 0 can not
happen can be used by RP software as an invalid serial number and for
example ignore all deltas in that case.

It is already a pain to work with those serial numbers because they are
unbounded. In rpki-client they have to fit in [1..2^63 - 1] if not you
get a 2nd chace via rsync.

-- 
:wq Claudio

---

From: Ties de Kock <[email-masked]>
Date: Wed, 15 Dec 2021 16:06:02 +0100

Hi Tim, all,

> On 15 Dec 2021, at 15:18, Tim Bruijnzeels <[email-masked]> wrote:
> 
> Hi Job, all,
> 

I think that is completely unambiguous but very easy to overlook. The question
of whether zero is a positive number (or a natural number) reminders me of some
university classes..

That paragraph you quoted, combined with

   o  The serial attribute MUST be an unbounded, unsigned positive
      integer in decimal format indicating the current version of the
      repository.

Makes it very clear that a compliant implementation MUST accept arbitrary
precision integers from 1..infinity.

Kind regards,
Ties

>>   (http://books.xmlschemata.org/relaxng/ch19-77247.html <http://books.xmlschemata.org/relaxng/ch19-77247.html>) to make 0 a legal
>>   value.
> 
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/sidrops <https://www.ietf.org/mailman/listinfo/sidrops>

---

From: Job Snijders <[email-masked]>
Date: Wed, 15 Dec 2021 16:24:10 +0100

On Wed, Dec 15, 2021 at 04:06:02PM +0100, Ties de Kock wrote:
> Makes it very clear that a compliant implementation MUST accept
> arbitrary precision integers from 1..infinity.

Your honor, I object!

As I understand the specification of "xsd:positiveInteger", the presence
of a decimal point (even when followed only by insignificant zeros) is
forbidden.

According to W3 docs: positiveInteger is derived from nonNegativeInteger,
which is derived from integer, which is derived from decimal - by fixing
the value of fractionDigits to be 0.

Kind regards,

Job

---

From: Rob Austein <[email-masked]>
Date: Fri, 17 Dec 2021 16:11:15 -0500

Once upon a time the RRDP RelaxNG schema said

  serial  = xsd:nonNegativeInteger

Somewhere along the road to publication as RFC 8182 that became

  serial  = xsd:positiveInteger

No recollection of why that change was thought necessary or useful.

Always fun when a confirming implementation has the specification
changed out from underneath it.