search

cloudflare / gortr

The RPKI-to-Router server used at Cloudflare
https://rpki.cloudflare.com
BSD 3-Clause "New" or "Revised" License
309 stars 39 forks source link

Serial aren't updated #64

Closed draskolnikova closed 4 years ago

draskolnikova commented 4 years ago

Hello!

I found that the serial from gortr output wasn't updated, is it expected?

gortr -verify.key=/opt/gortr/cmd/gortr/cf.pub -refresh=600
INFO[0004] New update (145656 uniques, 145656 total prefixes). 0 bytes. Updating sha256 hash  -> 87b512968180b25859bfae6d1f1cffa8f1a1aed0dba71443a623c09b82fc894e
INFO[0004] Updated added, new serial 0
INFO[0004] GoRTR Server started (sessionID:41350, refresh:3600, retry:600, expire:7200)
INFO[0023] Accepted tcp connection from [redacted]:52722 (1/0)
INFO[0604] HTTP 304 Not modified for https://rpki.cloudflare.com/rpki.json

The serial always zero (0).

lspgn commented 4 years ago

Hello, In the latest version, there are new serial modes. By default, the first iteration when GoRTR is started, the serial is zero. It will increase when the rpki.json has changed.

draskolnikova commented 4 years ago

@lspgn thanks for the info. Just wondering why, our ASN aren't 'secure' in isbgpsafeyet.com web, but it's marked as 'secure' at https://sg-pub.ripe.net/jasper/rpki-web-test/.

lspgn commented 4 years ago

Could you give me an IP address that would respond to ping behind the ASN? Could you run a traceroute to invalid.rpki.cloudflare.com?

draskolnikova commented 4 years ago

@lspgn just found the problems, I just direct connected to cloudflare and got the invalid rpki prefix accepted from the new peer. Just deploy RPKI and the status was valid.

Closing this issue, thanks in a bunch @lspgn for your response.