Closed job closed 4 years ago
Hi Job!
This happens due to a recent update. Currently there are 2 types of logs: the operation logs (enabled by default) and the validation logs (disabled by default). To learn more about them, visit https://nicmx.github.io/FORT-validator/logging.html.
Before v1.3.0 all the logs where "sent" to the same configured output. This caused some confusion amongst operators since apparently they believed they had done something wrong, even when that was not the case (several warnings were shown, all of them regarding RPKI objects validation).
So, as of today, you could use --validation-log.enabled
to get all the messages regarding RPKI objects validation (by default it has a 'warning' level).
Fantastic!
this is good output
job@vurt ~$ fort --validation-log.enabled --tal=/etc/rpki/arin.tal --rrdp.enabled=true --output.roa=- --mode=standalone --log.output=console --log.level=debug --log.enabled
Aug 13 14:22:58 ERR [Validation]: rsync://rpki.arin.net/repository/arin-rpki-ta/5e4a23ea-e80a-403e-b08c-2171da2157d3/5e4a23ea-e80a-403e-b08c-2171da2157d3.mft: Certificate validation failed: certificate signature failure
Aug 13 14:23:05 ERR [Validation]: rsync://rpki.arin.net/repository/arin-rpki-ta/5e4a23ea-e80a-403e-b08c-2171da2157d3/5e4a23ea-e80a-403e-b08c-2171da2157d3.mft: Certificate validation failed: certificate signature failure
Glad to help! :smiley:
There is an ongoing issue with the ARIN RPKI Trust Anchor https://www.arin.net/announcements/20200812/
The issue is explained in greater detail here http://sobornost.net/~job/arin-manifest-issue-2020.08.12.txt
In this situation
rpki-client
gives the following error:However, when running FORT, the below output gives very little to go on, I think operators would benefit from more insight into why the tree is not validating. (I believe FORT behaves correctly, just doesn't provide much debug info)