Fabien Vincent Posts

routinator@srv-rpki01:~$ cat .routinator.conf
# Routinator Configuration
#
# The configuration file is a TOML file. It consists of a sequence of
# key-value pairs, each on its own line. Strings are to be enclosed in
# double quotes. Lists of values can be given by enclosing a
# comma-separated sequence of these values in square brackets.
#
# See https://github.com/toml-lang/toml for detailed information on the
# format.
#
# This file contains all configuration settings with explanations and their
# default values.

# Repository directory
#
# This is where Routinator stores the local copy of the RPKI repository.
# Any relative path is interpreted with respect to the directory this config
# lives in.
#
# This setting is mandatory.
#
repository-dir = "/home/routinator/.rpki-cache/repository/"

# Trust Anchor Locator (TAL) directory
#
# All the files with the extension ".tal" in this directory are treated as
# trust anchor locators for RPKI validation.
#
# A relative path is interpreted with respect to the directory this config
# lives in.
#
# This setting is mandatory.
#
tal-dir = "/home/routinator/.rpki-cache/tals/"

# Local exceptions files
#
# This settings contains a array of paths to files that contain local
# exceptions. The files are JSON files according to RFC 8416 (aka SLURM).
exceptions = [
	"/home/routinator/.exceptions.slurm"
]

# Strict mode
#
# If strict mode, Routinator will stick to the requirements in the respective
# RFCs very strictly. See
# https://github.com/NLnetLabs/rpki-rs/blob/master/doc/relaxed-validation.md
# for information on what is allowed when strict mode is off.
#strict = false

# Rsync command
#
# This is the command to run as rsync. This is only command, no options.
rsync-command = "rsync"

# Rsync arguments
#
# This is a list of arguments to give to rsync.
#rsync-args = []

# Number of parallel rsync commands
#
# This is the maximum number of rsync commands that are run in parallel.
# We are not sure, if the current default is any good. Some feedback whether
# it is causing trouble or whether a higher value would even be fine is very
# much appreciated.
#
#rsync-count = 4

# Number of validation threads
#
# The number of threads that are used for validating the repository. The
# default value is the number of CPUs.
validation-threads = 2

# Refresh interval
#
# How often the repository should be updated and validated in RTR mode.
# Specifically, this is the number of seconds the process will wait after
# having finished validation before starting the next update.
#
# The default is the value indirectly recommended by RFC 8210.
refresh = 3600

# RTR retry interval
#
# This is the time an RTR client is told to wait before retrying a failed
# query in seconds.
retry = 600

# RTR expire interval
#
# This is the time an RTR client is told to keep using data if it can't
# refresh it.
# default = 7200 (2h) set to 6h
expire = 21600

# History size
#
# The number of deltas to keep. If a client requests an older delta, it is
# served the entire set again.
#
# There was no particular reason for choosing the default ...
history-size = 10

# Listen addresses for RTR TCP transport.
#
# This is an array of strings, each string a socket address of the form
# "address:port" with IPv6 address in square brackets.
rtr-listen = ["0.0.0.0:3323"]

# Listen addresses for Prometheus HTTP monitoring endpoint.
#
# This is an array of strings, each string a socket address of the form
# "address:port" with IPv6 address in square brackets.
#
# Port 9556 is allocated for the routinator exporter.
# https://github.com/prometheus/prometheus/wiki/Default-port-allocations
#
http-listen = ["0.0.0.0:8080"]

# Log level
#
# The maximum log level ("off", "error", "warn", "info", or "debug") for
# which to log messages.
log-level = "info"

# Log target
#
# Where to log to. One of "stderr" for stderr, "syslog" for syslog, or "file"
# for a file. If "file" is given, the "log-file" field needs to be given, too.
#
# Can also be "default", in which case "syslog" is used in daemon mode and
# "stderr" otherwise
log = "file"

# Syslog facility
#
# The syslog facility to log to if syslog logging is used.
#syslog-facility = "daemon"

# Log file
#
# The path to the file to log to if file logging is used. If the path is
# relative, it is relative to the directory this config file lives in.
log-file = "/home/routinator/logs/routinator.log"

# Daemon PID file
#
# When in daemon mode, Routinator can store its process ID in a file given
# through this entry. It will keep that file locked while running. By default,
# no pid file is used.
pid-file = "/home/routinator/routinator.pid"

# Daemon working directory
#
# If this entry is given, the daemon process will change its working directory
# to this directory. Otherwise it remains in the current directory.
#working-dir = "/home/routinator/"

# Daemon Chroot
#
# If this entry is given, the daemon process will change its root directory to
# this directory. Startup will fail if any of the other directories given is
# not within this directory.
#chroot = ...

routinator@srv-rpki01:~$ cat .exceptions.slurm
{
  "slurmVersion": 1,
  "validationOutputFilters": {
   "prefixFilters": [
      {
        "asn": 65551,
        "comment": "All VRPs matching our ASN 65551 as we do assertions below"
      }
   ],
   "bgpsecFilters": [
   ]
  },
  "locallyAddedAssertions": {
   "prefixAssertions": [
      {
      	"asn": 65551,
      	"prefix": "198.51.100.0/24",
      	"maxPrefixLength": 24,
      	"comment": "IPv4 TEST-NET2"
      }
   ],
   "bgpsecAssertions": [
   ]
  }
}

root@srv-rpki01:~# cat /etc/systemd/system/routinator.service
[Unit]
Description=Routinator RPKI daemon
After=network.target

[Service]
User=routinator
Group=routinator
RuntimeDirectory=routinator
RuntimeDirectoryPreserve=yes
RuntimeDirectoryMode=755

Environment=""
PIDFile=/home/routinator/routinator.pid

ExecStart=/home/routinator/.cargo/bin/routinator server --pid-file /home/routinator/routinator.pid --user routinator
Restart=on-failure

[Install]
WantedBy=multi-user.target

root@srv-rpki01:~# systemctl start routinator.service && tail -f /home/routinator/logs/*

root@srv-rpki01:~# systemctl status routinator.service
● routinator.service - Routinator RPKI daemon
   Loaded: loaded (/etc/systemd/system/routinator.service; enabled; vendor preset: enabled)
   Active: active (running) since Mon 2020-01-13 12:31:40 UTC; 2 weeks 3 days ago
 Main PID: 13469 (routinator)
    Tasks: 9 (limit: 2361)
   CGroup: /system.slice/routinator.service
           └─13469 /home/routinator/.cargo/bin/routinator server --pid-file /home/routinator/routinator.pid --user routinator

Jan 13 12:31:40 srv-rpki01 systemd[1]: Started Routinator RPKI daemon.

root@srv-rpki01:~# systemctl daemon-reload

root@srv-rpki01:~# systemctl enable routinator.service

curl https://sh.rustup.rs -sSf | sh
source ~/.cargo/env
cargo install routinator
routinator init
# Follow instructions provided
routinator server --rtr 127.0.0.1:3323

adduser rpki

# cat /etc/ssh/sshd_config
[...]
PermitRootLogin no
# needed for user RPKI
PasswordAuthentication yes
[...]
# Define an `rpki-rtr` subsystem which is actually `netcat` used to proxy STDIN/STDOUT to a running `routinator rtrd -a -l 127.0.0.1:3323`
Subsystem       rpki-rtr        /bin/nc 127.0.0.1 3323
[...]
# Certain routers may use old KEX algos and Ciphers which are no longer enabled by default.
# These examples are required in IOS-XR 5.3 but no longer enabled by default in OpenSSH 7.3
Ciphers +3des-cbc
KexAlgorithms +diffie-hellman-group1-sha1

router bgp 64567
!
 rpki server 1.2.3.4
  username rpki
  password rpkipassword
  transport ssh port 22
  refresh-time 3600
  response-time 600

ssh client v2
ssh client vrf myVRF
ssh client source-interface Loopback10

bgp[1064]: %ROUTING-BGP-5-RPKI_ADJCHANGE : 1.2.3.4 UP

RP/0/RP0/CPU0:router#sh bgp rpki summary

RPKI cache-servers configured: 1
RPKI database
  Total IPv4 net/path: 97550/105601
  Total IPv6 net/path: 15818/17522

RP/0/RP0/CPU0:router#sh bgp rpki server 1.2.3.4

RPKI Cache-Server 1.2.3.4
  Transport: SSH port 22
  Connect state: ESTAB
  Conn attempts: 1
  Total byte RX: 4080600
  Total byte TX: 7652
SSH information
  Username: rpki
  Password: *****
  SSH PID: 674259340
RPKI-RTR protocol information
  Serial number: 727
  Cache nonce: 0x79CA
  Protocol state: DATA_END
  Refresh  time: 3600 seconds
  Response time: 600 seconds
  Purge time: 60 seconds
  Protocol exchange
    ROAs announced: 131296 IPv4   23152 IPv6
    ROAs withdrawn:  25695 IPv4    5630 IPv6
    Error Reports :      0 sent       0 rcvd

RP/0/RP0/CPU0:router#sh bgp rpki table

  Network               Maxlen          Origin-AS         Server
  1.0.0.0/24            24              13335             1.2.3.4
  1.1.1.0/24            24              13335             1.2.3.4
  1.6.132.240/29        29              9583              1.2.3.4
  1.9.0.0/16            24              4788              1.2.3.4
  1.9.12.0/24           24              65037             1.2.3.4
  1.9.21.0/24           24              24514             1.2.3.4
[...]

router bgp 64567
 !
 address-family ipv4 unicast
  bgp origin-as validation enable
  bgp bestpath origin-as use validity
  bgp bestpath origin-as allow invalid
 !
 address-family ipv6 unicast
  bgp origin-as validation enable
  bgp bestpath origin-as use validity
  bgp bestpath origin-as allow invalid
 !

RP/0/RP0/CPU0:router# sh bgp 1.1.1.0/24 bestpath-compare

router bgp 64567 bgp origin-as validation time 30
router bgp 64567 address-family ipv4 unicast bgp origin-as validation enable
router bgp 64567 address-family ipv4 unicast bgp bestpath origin-as allow invalid
router bgp 64567 address-family ipv6 unicast bgp origin-as validation enable
router bgp 64567 address-family ipv6 unicast bgp bestpath origin-as allow invalid

route-policy RP_DROP_RPKI_INVALID
  if validation-state is invalid then
    drop
  endif
end-policy

route-policy RP_EBGP_PEER_IN
  apply RP_DROP_BOGONS
  apply RP_DROP_DEFAULT_ROUTE
  apply RP_DROP_RPKI_INVALID
  [...]
end-policy