search

dragonresearch / rpki.net

Dragon Research Labs rpki.net RPKI toolkit
54 stars 26 forks source link

Why we see so many revoked manifests from APNIC #127

Closed sraustein closed 8 years ago

sraustein commented 13 years ago

{{{ rsync://rpki.apnic.net/member_repository/A9111EE2/1BAB1D2E6C9711DE889D509B864992D1/Zhmyv7c0bIgdIVKVoPCzT_13NyE.mft 2011-10-31T15:06:39Z certificate_failed_validation backup rsync://rpki.apnic.net/member_repository/A9111EE2/1BAB1D2E6C9711DE889D509B864992D1/Zhmyv7c0bIgdIVKVoPCzT_13NyE.mft 2011-10-31T15:06:39Z mib_openssl_X509_V_ERR_CERT_REVOKED backup rsync://rpki.apnic.net/member_repository/A9111EE2/1BAB1D2E6C9711DE889D509B864992D1/Zhmyv7c0bIgdIVKVoPCzT_13NyE.mft 2011-10-31T15:06:39Z object_accepted current rsync://rpki.apnic.net/member_repository/A9113706/CDEFB354D74C11DD9BC41394864992D1/l4FYA3D1qZ0RisxU4mwlytrmw-k.mft 2011-10-31T15:07:55Z certificate_failed_validation backup rsync://rpki.apnic.net/member_repository/A9113706/CDEFB354D74C11DD9BC41394864992D1/l4FYA3D1qZ0RisxU4mwlytrmw-k.mft 2011-10-31T15:07:55Z mib_openssl_X509_V_ERR_CERT_REVOKED backup rsync://rpki.apnic.net/member_repository/A9113706/CDEFB354D74C11DD9BC41394864992D1/l4FYA3D1qZ0RisxU4mwlytrmw-k.mft 2011-10-31T15:07:55Z object_accepted current rsync://rpki.apnic.net/member_repository/A91144AB/065DEB30669E11DEBB46C5B7864992D1/2m7zn1Zhv-EhTNjJKgs9klFb5Zs.mft 2011-10-31T15:07:55Z certificate_failed_validation backup rsync://rpki.apnic.net/member_repository/A91144AB/065DEB30669E11DEBB46C5B7864992D1/2m7zn1Zhv-EhTNjJKgs9klFb5Zs.mft 2011-10-31T15:07:55Z mib_openssl_X509_V_ERR_CERT_REVOKED backup rsync://rpki.apnic.net/member_repository/A91144AB/065DEB30669E11DEBB46C5B7864992D1/2m7zn1Zhv-EhTNjJKgs9klFb5Zs.mft 2011-10-31T15:07:55Z object_accepted current }}}

etcetera ad nausium. Lots of these.

Haven't figured out yet whether this is the usual race condition (multiple paths to the same URI) or something weird APNIC is doing. Note that URI they're using //is// stable, per spec. So why are we even testing the backup when the current is ok?

This might be a bug in rcynic, a bug in rcynic.py, or something weird APNIC is doing (like not cleaning up old stuff after revoking it).

Needs investigation.

Trac ticket #117 component rcynic priority minor, owner sra, created by sra on 2011-10-31T15:36:01Z, last modified 2016-08-05T17:04:44Z

sraustein commented 8 years ago

Closed with resolution wontfix