Skip to content
This repository has been archived by the owner on Jun 9, 2024. It is now read-only.

APNIC rsync failback and LANIC AS0 #104

Open
sarasalingam opened this issue Nov 23, 2021 · 10 comments
Open

APNIC rsync failback and LANIC AS0 #104

sarasalingam opened this issue Nov 23, 2021 · 10 comments

Comments

@sarasalingam
Copy link

In the cloudflare OctoRPKI, we have disabled the rrdp failover "-rrdp.failover=false" but still for few URLs its going for the rsync (For APNIC)

Please find below log for the same –

TYPE rsync_errors gauge

rsync_errors {address="rsync://rpki-repository.nic.ad.jp/ap"} 146
rsync_errors{address="rsync://rpki.apnic.net/repository"} 146

Could you please help us to identify the possible issue? We understand why is the cause for JPNIC but not for APNIC ? Even though rsync fails, the ROA counts are correct for APNIC compared to the public sites since it is downloading via RRDP.

Nov 19 08:34:16 rpki01 bbe10dbee28e[1531]: time="2021-11-18T21:34:16Z" level=info msg="RRDP: Downloading root notification https://rrdp.apnic.net/notification.xml"
Nov 19 08:34:16 rpki01 bbe10dbee28e[1531]: time="2021-11-18T21:34:16Z" level=info msg="RRDP: https://rrdp.apnic.net/notification.xml has 3 deltas to parse (cur: 95753, last: 95750)"
Nov 19 08:37:00 rpki01 bbe10dbee28e[1531]: time="2021-11-18T21:37:00Z" level=info msg="RRDP sync https://rrdp.sub.apnic.net/notification.xml"
Nov 19 08:37:00 rpki01 bbe10dbee28e[1531]: time="2021-11-18T21:37:00Z" level=info msg="RRDP: Downloading root notification https://rrdp.sub.apnic.net/notification.xml"
Nov 19 08:37:00 rpki01 bbe10dbee28e[1531]: time="2021-11-18T21:37:00Z" level=info msg="RRDP: https://rrdp.sub.apnic.net/notification.xml has 0 deltas to parse (cur: 1696, last: 1696)"

Also we have noticed, OctoRPKI is not fetching the data for LANIC-AS0 tal. Please advise why it is working for APNIC AS0 not for LANIC AS0.

100 17736 17714 66 Nov18 ? 1-11:56:46 ./octorpki -tal.root=tals/afrinic.tal,tals/apnic.tal,tals/arin.tal,tals/lacnic.tal,tals/ripe.tal,tals/lacnic-as0.tal -tal.name=AFRINIC,APNIC,ARIN,LACNIC,RIPE,LACNIC-AS0 -output.sign=false -rrdp.failover=false -refresh=600
100 17896 17876 6 Nov18 ? 03:43:42 ./gortr -loglevel debug -refresh 600 -rtr.refresh 600 -slurm /configs/slurm.json -ssh.bind :8282 -ssh.key private_new.pem -ssh.method.password=true -ssh.auth.user rpki -ssh.auth.password rpki -bind :8283 -cache http://octorpk:8081/output.json -verify=false
@ties
Copy link

ties commented Nov 24, 2021

What version of octorpki are you running - especially if using docker (since the public image is not up to date)?

@ties
Copy link

ties commented Nov 24, 2021

And for the LACNIC AS0 tal: Please check the content of the tal file. I had to manually add line breaks.

@sarasalingam
Copy link
Author

sarasalingam commented Nov 24, 2021 via email •
edited
Loading

@sarasalingam
Copy link
Author

sarasalingam commented Nov 24, 2021 via email •
edited
Loading

@sarasalingam
Copy link
Author

sarasalingam commented Nov 24, 2021 via email •
edited
Loading

@ties
Copy link

ties commented Nov 24, 2021 •
edited
Loading

Hi Skanda,

I see the same whitespace that was in my tal file in that file (for example, before "5l1f"). It looks like OctoRPKI supports line breaks but not spaced within the lines.

# in your paste, there are whitespaces within a line:
...
1a3CutCe92yJ5z9VTJQYXPw32ti0gAAERCepr21y4sO4rJiJtdDGk2+ezFzSgvgitX+/aqaoTpsD HCcSu0ScdsuY+XIQuq0f/Pcg/ClwSmRX2M+7nsbiOHv0GP4VubEW14u9lvu+XdpaPcZVBRldaP9h 5I1f2QIDAQAB
# versus
$ cat ./lacnic-as0.tal
https://rrdp.lacnic.net/ta/rta-lacnic-rpki-as0.cer
rsync://repository.lacnic.net/rpkias0/lacnic/rta-lacnic-rpki-as0.cer

MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAhW5FgZ9Foda5ZpboK99IzhnBG4Gu9t0M
bzaqUI7rEH70RKbxpYtBguktrwVX3CaK7BiDtxOEtQv6iikt2DyfLZ14tpwoh/1NBqPilb+PfvNC
N75LU9WYv5Fy651bC+N9kO7tAZeWY1NhZCYi3FjFjBRvv7IbUuWx5Us+xoV0g1jVVI5PI69Cbp/j
1a3CutCe92yJ5z9VTJQYXPw32ti0gAAERCepr21y4sO4rJiJtdDGk2+ezFzSgvgitX+/aqaoTpsD
HCcSu0ScdsuY+XIQuq0f/Pcg/ClwSmRX2M+7nsbiOHv0GP4VubEW14u9lvu+XdpaPcZVBRldaP9h
5I1f2QIDAQAB

If you edit it such as in the attached copy it works for me:
lacnic-as0.tal.zip

@ties
Copy link

ties commented Nov 24, 2021

I spotted this by running with -loglevel debug:

octorpki_1                   | time="2021-11-24T10:12:03Z" level=info msg="Validator started"
octorpki_1                   | time="2021-11-24T10:12:03Z" level=info msg="Serving HTTP on :8081/output.json"
octorpki_1                   | time="2021-11-24T10:12:03Z" level=debug msg="Fetching /tals/lacnic-as0.tal->/tals/lacnic-as0.tal"
octorpki_1                   | time="2021-11-24T10:12:03Z" level=info msg="Still exploring. Revalidating now"
octorpki_1                   | time="2021-11-24T10:12:03Z" level=error msg="file error for certificate: illegal base64 data at input byte 76"
octorpki_1                   | time="2021-11-24T10:12:03Z" level=debug msg="Fetching /tals/lacnic-as0.tal->/tals/lacnic-as0.tal"
octorpki_1                   | time="2021-11-24T10:12:03Z" level=info msg="Stable state. Revalidating in 10m0s"
octorpki_1                   | time="2021-11-24T10:12:03Z" level=error msg="file error for certificate: illegal base64 data at input byte 76"

@sarasalingam
Copy link
Author

sarasalingam commented Nov 25, 2021 via email

@sarasalingam
Copy link
Author

sarasalingam commented Nov 25, 2021 •
edited
Loading

Thanks mate. The LACNIC AS 0 issue is resolved. your advise has resolved the issue for us.

@sarasalingam
Copy link
Author

We are not why exactly it is falling back to rsync for APNIC. Please advise.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@ties @sarasalingam