ca0 pub dir structure

[sraustein]

in ca0.rpki.net::/usr/local/share/rpki/publication/, esnet is at the top level, but IETF and rgnet are under altCA. why?

ca0.rpki.net:/usr/local/share/rpki/publication# l total 20 drwxr-xr-x 6 root wheel 512 Apr 14 18:19 altCA/ -rw-r--r-- 1 root wheel 1195 Apr 4 01:39 altCA.cer drwxr-xr-x 3 root wheel 512 Apr 12 01:07 esnet/ -rw-r--r-- 1 root wheel 420 Apr 4 01:39 root.crl -rw-r--r-- 1 root wheel 1724 Apr 4 01:39 root.mft ca0.rpki.net:/usr/local/share/rpki/publication# cd altCA ca0.rpki.net:/usr/local/share/rpki/publication/altCA# ls 1/ IETF/ rgnet/ workshop/

Trac ticket #513 component rpkid priority minor, owner sra, created by randy on 2013-04-16T17:25:54Z, last modified 2016-08-05T17:37:59Z

[sraustein]

in ca0.rpki.net::/usr/local/share/rpki/publication/, esnet is at the top level, but IETF and rgnet are under altCA. why?

Impossible to say for certain without the XML you fed to rpkic and a copy of what rpkic said in response. Presumably rpkic decided that this was not a publication offer by altca to esnet and that it therefore could not put esnet under altca.

The (nasty) logic that controls that set of tests changed recently, as it used to rely on the handle name specified in rpki.conf (and was wrong in any case -- couldn't cope with multiple top-level publication sites offering publication to their respective children, for example).

It is of course possible that I broke something in that change. I'll go peer at the code to see if anything is (now) obvious.

Trac comment by sra on 2013-04-16T18:09:10Z

[sraustein]

See rpki.irdb.zookeeper.Zookeeper.configure_publication_client() for details, but, in summary, when we receive something that claims to be an offer:

• We look for the ResourceHolderCA which has a child whose BPKI TA matches the client_ta in the XML; this resource holder is the parent of the entity that wants to be our publication client.
• If we find no such parent, we don't host the parent, so we don't consider this a valid offer (because we didn't make it).
• If we found the parent but the parent itself is not top-level, we don't consider this a valid offer (because it should have been a referral, not an offer).
• Otherwise, we accept it as an offer and home under the parent.

If we don't consider this to be a valid offer, we do accept the request anyway, we just home it at top-level.

Trac comment by sra on 2013-04-16T18:21:06Z

[sraustein]

Log chipper

Trac comment by sra on 2016-08-05T17:37:59Z

[sraustein]

Closed with resolution wontfix