search

NLnetLabs / routinator

An RPKI Validator and RTR server written in Rust
https://nlnetlabs.nl/projects/routing/routinator/
BSD 3-Clause "New" or "Revised" License
465 stars 70 forks source link

The same command behaves differently. #855

Closed yushoyamaguchi closed 1 year ago

yushoyamaguchi commented 1 year ago 
routinator -v --config /etc/routinator/routinator.conf update
routinator -v --config /etc/routinator/routinator.conf vrps

1

routinator -v --config /etc/routinator/routinator.conf --rrdp-root-cert=rootCA.crt update
routinator -v --config /etc/routinator/routinator.conf --rrdp-root-cert=rootCA.crt vrps

2b

routinator -v --config /etc/routinator/routinator.conf update
routinator -v --config /etc/routinator/routinator.conf vrps

2c

Like above pictures, vrps command's behavior are different before and after executing the command with --rrdp-root-cert option.

partim commented 1 year ago

That is correct. By default, Routinator only falls back to rsync if it hasn’t successfully managed to retrieve the repository via RRDP before and the copy it has isn’t older than an hour. In your third example, it uses this copy. There seems to be no ROAs in the RRDP-version of your repository, so the outputs in the second and third picture are empty.

You can change this behaviour through the rrdp-fallback-policy option.

As an aside, the vrps command also updates the data, so you don’t need to run update first.

yushoyamaguchi commented 1 year ago

Thank you very much.

yushoyamaguchi commented 1 year ago

@partim I'm sorry for repeating questions. In, the second image, no RRDP error message was generated. However, no validated ROA information is displayed. Is there a way to know where the error occured?

partim commented 1 year ago

You could try and run Routinator with -vv so it logs more details. If that doesn’t result in any message either, then it looks a bit like your RRDP repository doesn’t actually contain the ROA?