CVE-2021-43114: Other (NVD-CWE-Other)
value: FORT Validator versions prior to 1.5.2 will crash if an RPKI CA publishes an X.509 EE certificate. This will lead to RTR clients such as BGP routers to lose access to the RPKI VRP data set, effectively disabling Route Origin Validation.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 7.5
Published: 2021-11-09T13:15Z
Repository: https://github.com/NICMx/FORT-validator
Language: Markdown
Files changed: docs/_config.yml, docs/intro-fort.md, docs/usage.md, man/fort.8, src/object/certificate.c
Commit date: 2021-10-19 17:44:35 -0500
Commit message: Protocolary updates for release 1.5.2

Diff: diff --git a/docs/_config.yml b/docs/_config.yml
index 0730e67..7803c0e 100644
--- a/docs/_config.yml
+++ b/docs/_config.yml
@@ -6,11 +6,11 @@ defaults:
       path: "" # an empty string here means all files in the project
     values:
       layout: "default"
       image: "/img/logo_validador_og.png"
 
-fort-latest-version: 1.5.1
+fort-latest-version: 1.5.2
 plugins:
   - jekyll-seo-tag
   - jekyll-sitemap
 #SEO configuration
 title: "FORT Validator - RPKI Relying Party"
diff --git a/docs/intro-fort.md b/docs/intro-fort.md
index aed6a3e..ccc4735 100644
--- a/docs/intro-fort.md
+++ b/docs/intro-fort.md
@@ -30,11 +30,11 @@ Further information can be found in the subsections below.
 | [6493](https://tools.ietf.org/html/rfc6493) (Ghostbusters)                 | 100%        |
 | [6810](https://tools.ietf.org/html/rfc6810) (RTR Version 0)                | 100%        |
 | [7318](https://tools.ietf.org/html/rfc7318) (Policy Qualifiers)            | 100%        |
 | [7935](https://tools.ietf.org/html/rfc7935) (RPKI algorithms)              | 100%        |
 | [8182](https://tools.ietf.org/html/rfc8182) (RRDP)                         | 100%        |
-| [8209](https://tools.ietf.org/html/rfc8209) (BGPSec Certificates)          | 100%        |
+| [8209](https://tools.ietf.org/html/rfc8209) (BGPSec Certificates)          | 0% (This code was [disabled](https://github.com/NICMx/FORT-validator/issues/58#issuecomment-941977925) in version 1.5.2) |
 | [8210](https://tools.ietf.org/html/rfc8210) (RTR Version 1)                | 100%        |
 | [8360](https://tools.ietf.org/html/rfc8360) (Validation Reconsidered)      | 100%        |
 | [8416](https://tools.ietf.org/html/rfc8416) (SLURM)                        | 100%        |
 | [8608](https://tools.ietf.org/html/rfc8608) (BGPsec algorithms)            | 100%        |
 | [8630](https://tools.ietf.org/html/rfc8630) (TALs with HTTPS URIs)         | 100%        |
diff --git a/docs/usage.md b/docs/usage.md
index 6db5e27..74c5a2c 100644
--- a/docs/usage.md
+++ b/docs/usage.md
@@ -760,22 +760,10 @@ The value specified is utilized in libcurl's option [CURLOPT_CAPATH](https://cur
 ### `--output.roa`
 
 - **Type:** String (Path to file)
 - **Availability:** `argv` and JSON
 
-> Note: The paragraphs below apply to [Fort 1.5.0](https://github.com/NICMx/FORT-validator/releases/tag/v1.5.0).
-
-File where the ROAs (found during each validation run) will be stored (in CSV format).
-
-If the file already exists, it will be overwritten. If it doesn't exist, it will be created. To print to standard output, use a hyphen (`-`). If the RTR server is [enabled](#--mode), then the ROAs will be printed every [`--server.interval.validation`](#--serverintervalvalidation) seconds.
-
-Each line of the result is printed in the following order: _AS, Prefix, Max prefix length_. The first line contains the column names.
-
-If `--output.roa` is omitted, the ROAs are not printed.
-
-> Note: The paragraphs below apply to [Fort master](https://github.com/NICMx/FORT-validator).
-
 File where the ROAs (found during each validation run) will be stored. See [`--output.format`](#--outputformat).
 
 If the file already exists, it will be overwritten. If it doesn't exist, it will be created. To print to standard output, use a hyphen (`-`). If the RTR server is [enabled](#--mode), then the ROAs will be printed every [`--server.interval.validation`](#--serverintervalvalidation) secs.
 
 When `--output.format` equals `csv`, each line of the result is printed in the following order: _AS, Prefix, Max prefix length_. The first line contains the column names.
@@ -804,23 +792,11 @@ If `--output.roa` is omitted, the ROAs are not printed.
 ### `--output.bgpsec`
 
 - **Type:** String (Path to file)
 - **Availability:** `argv` and JSON
 
-> Note: The paragraphs below apply to [Fort 1.5.0](https://github.com/NICMx/FORT-validator/releases/tag/v1.5.0).
-
-File where the BGPsec Router Keys (found during each validation run) will be stored (in CSV format).
-
-Since most of the data (Subject Key Identifier and Subject Public Key Info) is binary, it is base64url-encoded, without trailing pads.
-
-If the file already exists, it will be overwritten. If it doesn't exist, it will be created. To print to standard output console, use a hyphen (`-`). If the RTR server is [enabled](#--mode), the BGPsec Router Keys will be printed every [`--server.interval.validation`](#--serverintervalvalidation) seconds.
-
-Each line of the result is printed in the following order: _AS, Subject Key Identifier, Subject Public Key Info_. The first line contains the column names.
-
-If `--output.bgpsec` is ommited, then the BGPsec Router Keys are not printed.
-
-> Note: The paragraphs below apply to [Fort master](https://github.com/NICMx/FORT-validator).
+> ![Warning!](img/warn.svg) BGPsec certificate validation has been disabled in version 1.5.2 because of [this bug](https://github.com/NICMx/FORT-validator/issues/58). It will be restored in version 1.5.3.
 
 File where the BGPsec Router Keys (found during each validation run) will be stored. See [`--output.format`](#--outputformat).
 
 Since most of the data (Subject Key Identifier and Subject Public Key Info) is binary, it is base64url-encoded, without trailing pads.
 
@@ -853,12 +829,10 @@ If `--output.bgpsec` is ommited, then the BGPsec Router Keys are not printed.
 
 - **Type:** Enumeration (`csv`, `json`)
 - **Availability:** `argv` and JSON
 - **Default:** `csv`
 
-> Note: This flag only exists in [Fort master](https://github.com/NICMx/FORT-validator).
-
 Output format for [`--output.roa`](#--outputroa) and [`--output.bgpsec`](#--outputbgpsec).
 
 ### `--asn1-decode-max-stack`
 
 - **Type:** Integer
diff --git a/man/fort.8 b/man/fort.8
index aa2636d..b14e792 100644
--- a/man/fort.8
+++ b/man/fort.8
@@ -1,6 +1,6 @@
-.TH fort 8 "2021-08-05" "v1.5.1" "FORT validator"
+.TH fort 8 "2021-10-19" "v1.5.2" "FORT validator"
 
 .SH NAME
 fort \- RPKI validator and RTR server
 
 .SH SYNOPSIS
@@ -486,10 +486,20 @@ By default, it has a value of \fI7200\fR. Minimum allowed value: \fI600\fR,
 maximum allowed value \fI172800\fR. It must be larger than
 \fIserver.interval.refresh\fR and \fIserver.interval.retry\fR.
 .RE
 .P
 
+.B \-\-server.deltas.lifetime=\fIUNSIGNED_INTEGER\fR
+.RS 4
+When routers first connect to Fort, they request a snapshot of the validation results. (ROAs and Router Keys.) Because they need to keep their validated objects updated, and snapshots tend to be relatively large amounts of information, they request deltas afterwards over configurable intervals. ("Deltas" being the differences between snapshots.)
+.P
+During each validation cycle, Fort generates a new snapshot, as well as the deltas needed to build the new snapshot from the previous one. These are all stored in RAM. \fI--server.deltas.lifetime\fR is the number of iterations a set of deltas will be kept before being deallocated. (Recall that every iteration lasts \fI--server.interval.validation\fR seconds, plus however long the validation takes.)
+.P
+If a router lags behind, to the point Fort has already deleted the deltas it needs to update the router’s snapshot, Fort will have to fall back to fetch the entire latest snapshot instead.
+.RE
+.P
+
 .B \-\-log.enabled=\fItrue\fR|\fIfalse\fR
 .RS 4
 Enables the operation logs.
 .P
 By default, it has a value of \fItrue\fR (these logs are enabled).
diff --git a/src/object/certificate.c b/src/object/certificate.c
index ca52f7a..57d3022 100644
--- a/src/object/certificate.c
+++ b/src/object/certificate.c
@@ -1851,10 +1851,11 @@ get_certificate_type(X509 *cert, bool is_ta, enum cert_type *result)
 	if (has_bgpsec_router_eku(cert)) {
 		*result = BGPSEC;
 		return 0;
 	}
 
+	*result = EE; /* Shuts up nonsense gcc 8.3 warning */
 	return pr_val_err("Certificate is not TA, CA nor BGPsec. Ignoring...");
 }
 
 /*
  * It does some of the things from validate_issuer(), but we can not wait for

Vulnerable code: fort-latest-version: 1.5.1
| [8209](https://tools.ietf.org/html/rfc8209) (BGPSec Certificates)          | 100%        |
> Note: The paragraphs below apply to [Fort 1.5.0](https://github.com/NICMx/FORT-validator/releases/tag/v1.5.0).

File where the ROAs (found during each validation run) will be stored (in CSV format).

If the file already exists, it will be overwritten. If it doesn't exist, it will be created. To print to standard output, use a hyphen (`-`). If the RTR server is [enabled](#--mode), then the ROAs will be printed every [`--server.interval.validation`](#--serverintervalvalidation) seconds.

Each line of the result is printed in the following order: _AS, Prefix, Max prefix length_. The first line contains the column names.

If `--output.roa` is omitted, the ROAs are not printed.

> Note: The paragraphs below apply to [Fort master](https://github.com/NICMx/FORT-validator).

> Note: The paragraphs below apply to [Fort 1.5.0](https://github.com/NICMx/FORT-validator/releases/tag/v1.5.0).

File where the BGPsec Router Keys (found during each validation run) will be stored (in CSV format).

Since most of the data (Subject Key Identifier and Subject Public Key Info) is binary, it is base64url-encoded, without trailing pads.

If the file already exists, it will be overwritten. If it doesn't exist, it will be created. To print to standard output console, use a hyphen (`-`). If the RTR server is [enabled](#--mode), the BGPsec Router Keys will be printed every [`--server.interval.validation`](#--serverintervalvalidation) seconds.

Each line of the result is printed in the following order: _AS, Subject Key Identifier, Subject Public Key Info_. The first line contains the column names.

If `--output.bgpsec` is ommited, then the BGPsec Router Keys are not printed.

> Note: The paragraphs below apply to [Fort master](https://github.com/NICMx/FORT-validator).
> Note: This flag only exists in [Fort master](https://github.com/NICMx/FORT-validator).

.TH fort 8 "2021-08-05" "v1.5.1" "FORT validator"
Fixed code: fort-latest-version: 1.5.2
| [8209](https://tools.ietf.org/html/rfc8209) (BGPSec Certificates)          | 0% (This code was [disabled](https://github.com/NICMx/FORT-validator/issues/58#issuecomment-941977925) in version 1.5.2) |
> ![Warning!](img/warn.svg) BGPsec certificate validation has been disabled in version 1.5.2 because of [this bug](https://github.com/NICMx/FORT-validator/issues/58). It will be restored in version 1.5.3.
.TH fort 8 "2021-10-19" "v1.5.2" "FORT validator"
.B \-\-server.deltas.lifetime=\fIUNSIGNED_INTEGER\fR
.RS 4
When routers first connect to Fort, they request a snapshot of the validation results. (ROAs and Router Keys.) Because they need to keep their validated objects updated, and snapshots tend to be relatively large amounts of information, they request deltas afterwards over configurable intervals. ("Deltas" being the differences between snapshots.)
.P
During each validation cycle, Fort generates a new snapshot, as well as the deltas needed to build the new snapshot from the previous one. These are all stored in RAM. \fI--server.deltas.lifetime\fR is the number of iterations a set of deltas will be kept before being deallocated. (Recall that every iteration lasts \fI--server.interval.validation\fR seconds, plus however long the validation takes.)
.P
If a router lags behind, to the point Fort has already deleted the deltas it needs to update the router’s snapshot, Fort will have to fall back to fetch the entire latest snapshot instead.
.RE
.P

	*result = EE; /* Shuts up nonsense gcc 8.3 warning */