NASP/rpki
84
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

20260609 CIR区分fresh和cached验证输入

Browse Source
This commit is contained in:
yuyr
2026-06-11 19:13:48 +08:00
parent 74012c686d
commit 4047214ddf
26 changed files with 1054 additions and 552 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/bin/cir_drop_report.rs
View File

@@ -127,7 +127,7 @@ fn main() -> Result<(), String> {
.map_err(|e| format!("open repo bytes db failed: {e}"))?;
let mut object_hash_by_uri = BTreeMap::new();
for object in &cir.objects {
for object in cir.validated_objects() {
object_hash_by_uri.insert(object.rsync_uri.clone(), hex::encode(&object.sha256));
}

33
src/bin/cir_dump_reject_list.rs
View File

@@ -56,9 +56,24 @@ fn real_main() -> Result<(), String> {
.map_err(|e| format!("read cir failed: {}: {e}", cir_path.display()))?;
let cir = rpki::cir::decode_cir(&bytes).map_err(|e| format!("decode cir failed: {e}"))?;
println!("object_count={}", cir.objects.len());
println!("version={}", cir.version);
println!("object_count={}", cir.validated_object_count());
println!("fresh_object_count={}", cir.fresh_validated_objects.len());
println!("cached_object_count={}", cir.cached_validated_objects.len());
println!(
"object_list_sha256={}",
hex::encode(&cir.object_list_sha256)
);
println!(
"fresh_object_list_sha256={}",
hex::encode(&cir.fresh_object_list_sha256)
);
println!(
"cached_object_list_sha256={}",
hex::encode(&cir.cached_object_list_sha256)
);
println!("trust_anchor_count={}", cir.trust_anchors.len());
for (index, item) in cir.objects.iter().take(args.limit).enumerate() {
for (index, item) in cir.validated_objects().take(args.limit).enumerate() {
println!(
"{:04} object={} sha256={}",
index + 1,
@@ -70,8 +85,18 @@ fn real_main() -> Result<(), String> {
"reject_list_sha256={}",
hex::encode(&cir.reject_list_sha256)
);
println!("reject_count={}", cir.rejected_objects.len());
for (index, item) in cir.rejected_objects.iter().take(args.limit).enumerate() {
println!("reject_count={}", cir.rejected_object_count());
println!("fresh_reject_count={}", cir.fresh_rejected_objects.len());
println!("cached_reject_count={}", cir.cached_rejected_objects.len());
println!(
"fresh_reject_list_sha256={}",
hex::encode(&cir.fresh_reject_list_sha256)
);
println!(
"cached_reject_list_sha256={}",
hex::encode(&cir.cached_reject_list_sha256)
);
for (index, item) in cir.rejected_objects().take(args.limit).enumerate() {
println!(
"{:04} uri={} reason={}",
index + 1,

26
src/bin/cir_probe_rpki_client_cache.rs
View File

@@ -108,13 +108,11 @@ fn run(args: Args) -> Result<(), String> {
let peer = decode_cir(&read_file(peer_cir_path)?)
.map_err(|e| format!("decode rpki-client CIR failed: {e}"))?;
let peer_objects = peer
.objects
.iter()
.validated_objects()
.map(|item| item.rsync_uri.as_str())
.collect::<BTreeSet<_>>();
let only_in_ours = ours
.objects
.iter()
.validated_objects()
.filter(|item| !peer_objects.contains(item.rsync_uri.as_str()))
.map(|item| ProbeObject {
uri: item.rsync_uri.clone(),
@@ -442,10 +440,7 @@ fn uri_extension(uri: &str) -> String {
#[cfg(test)]
mod tests {
use super::*;
use rpki::cir::{
CIR_VERSION_V3, CanonicalInputRepresentation, CirHashAlgorithm, CirObject,
CirRejectedObject, CirTrustAnchor, compute_reject_list_sha256, encode_cir,
};
use rpki::cir::{CanonicalInputRepresentation, CirObject, CirTrustAnchor, encode_cir};
#[test]
fn parse_args_accepts_required_flags() {
@@ -663,15 +658,14 @@ mod tests {
})
.collect::<Vec<_>>();
objects.sort_by(|left, right| left.rsync_uri.cmp(&right.rsync_uri));
CanonicalInputRepresentation {
version: CIR_VERSION_V3,
hash_alg: CirHashAlgorithm::Sha256,
validation_time: time::OffsetDateTime::UNIX_EPOCH,
CanonicalInputRepresentation::new_v4(
time::OffsetDateTime::UNIX_EPOCH,
objects,
trust_anchors: vec![sample_trust_anchor()],
reject_list_sha256: compute_reject_list_sha256(std::iter::empty::<&str>()),
rejected_objects: Vec::<CirRejectedObject>::new(),
}
Vec::new(),
vec![sample_trust_anchor()],
Vec::new(),
Vec::new(),
)
}
fn sample_trust_anchor() -> CirTrustAnchor {

67
src/bin/cir_state_compare.rs
View File

@@ -95,23 +95,19 @@ fn run(args: Args) -> Result<(), String> {
.map_err(|e| format!("decode rpki-client CIR failed: {e}"))?;
let ours_objects = ours
.objects
.iter()
.validated_objects()
.map(|item| (item.rsync_uri.clone(), hex::encode(&item.sha256)))
.collect::<BTreeMap<_, _>>();
let peer_objects = peer
.objects
.iter()
.validated_objects()
.map(|item| (item.rsync_uri.clone(), hex::encode(&item.sha256)))
.collect::<BTreeMap<_, _>>();
let ours_rejects = ours
.rejected_objects
.iter()
.rejected_objects()
.map(|item| item.object_uri.clone())
.collect::<BTreeSet<_>>();
let peer_rejects = peer
.rejected_objects
.iter()
.rejected_objects()
.map(|item| item.object_uri.clone())
.collect::<BTreeSet<_>>();
let ours_trust_anchors = ours
@@ -153,18 +149,18 @@ fn run(args: Args) -> Result<(), String> {
"trust_anchors": trust_anchor_summary.to_json(),
"rejectListSha256Match": reject_hash_match,
"ours": {
"objectCount": ours.objects.len(),
"objectCount": ours.validated_object_count(),
"talCount": ours.trust_anchors.len(),
"trustAnchorCount": ours.trust_anchors.len(),
"rejectCount": ours.rejected_objects.len(),
"rejectCount": ours.rejected_object_count(),
"rejectListSha256": hex::encode(&ours.reject_list_sha256),
"validationTime": ours.validation_time.to_string(),
},
"rpkiClient": {
"objectCount": peer.objects.len(),
"objectCount": peer.validated_object_count(),
"talCount": peer.trust_anchors.len(),
"trustAnchorCount": peer.trust_anchors.len(),
"rejectCount": peer.rejected_objects.len(),
"rejectCount": peer.rejected_object_count(),
"rejectListSha256": hex::encode(&peer.reject_list_sha256),
"validationTime": peer.validation_time.to_string(),
}
@@ -428,8 +424,8 @@ fn uri_extension(uri: &str) -> String {
mod tests {
use super::*;
use rpki::cir::{
CIR_VERSION_V3, CanonicalInputRepresentation, CirHashAlgorithm, CirObject,
CirRejectedObject, CirTrustAnchor, compute_reject_list_sha256, encode_cir, sha256,
CanonicalInputRepresentation, CirObject, CirRejectedObject, CirTrustAnchor, encode_cir,
sha256,
};
#[test]
@@ -533,7 +529,7 @@ mod tests {
assert_eq!(summary["rejects"]["match"], true);
assert_eq!(summary["trustAnchors"]["match"], true);
assert_eq!(summary["rejectListSha256Match"], true);
assert_eq!(summary["ours"]["objectCount"], 2);
assert_eq!(summary["ours"]["objectCount"], 3);
assert!(
std::fs::read_to_string(out_md)
.expect("read markdown")
@@ -721,6 +717,24 @@ mod tests {
trust_anchors: &[&str],
rejected_objects: &[(&str, Option<&str>)],
) -> CanonicalInputRepresentation {
let mut cir_objects = objects
.iter()
.map(|(rsync_uri, fill)| CirObject {
rsync_uri: (*rsync_uri).to_string(),
sha256: vec![*fill; 32],
})
.collect::<Vec<_>>();
for (object_uri, _) in rejected_objects {
if cir_objects
.iter()
.all(|object| object.rsync_uri != *object_uri)
{
cir_objects.push(CirObject {
rsync_uri: (*object_uri).to_string(),
sha256: vec![0xee; 32],
});
}
}
let rejected_objects = rejected_objects
.iter()
.map(|(object_uri, reason)| CirRejectedObject {
@@ -728,18 +742,11 @@ mod tests {
reason: reason.map(str::to_string),
})
.collect::<Vec<_>>();
CanonicalInputRepresentation {
version: CIR_VERSION_V3,
hash_alg: CirHashAlgorithm::Sha256,
validation_time: sample_time(),
objects: objects
.iter()
.map(|(rsync_uri, fill)| CirObject {
rsync_uri: (*rsync_uri).to_string(),
sha256: vec![*fill; 32],
})
.collect(),
trust_anchors: trust_anchors
CanonicalInputRepresentation::new_v4(
sample_time(),
cir_objects,
Vec::new(),
trust_anchors
.iter()
.map(|tal_uri| {
let name = tal_uri
@@ -758,11 +765,9 @@ mod tests {
}
})
.collect(),
reject_list_sha256: compute_reject_list_sha256(
rejected_objects.iter().map(|item| item.object_uri.as_str()),
),
rejected_objects,
}
Vec::new(),
)
}
fn write_cir(path: &Path, cir: &CanonicalInputRepresentation) {

20
src/bin/cir_ta_only_fixture.rs
View File

@@ -1,9 +1,6 @@
use std::path::PathBuf;
use rpki::cir::{
CIR_VERSION_V3, CanonicalInputRepresentation, CirHashAlgorithm, CirTrustAnchor,
compute_reject_list_sha256, encode_cir, sha256,
};
use rpki::cir::{CanonicalInputRepresentation, CirTrustAnchor, encode_cir, sha256};
const USAGE: &str = "Usage: cir_ta_only_fixture --tal-path <path> --ta-path <path> --tal-uri <url> --validation-time <rfc3339> --cir-out <path> --repo-bytes-db <path>";
@@ -102,21 +99,20 @@ fn main() -> Result<(), String> {
let ta_certificate_sha256 = sha256(&ta_bytes);
let cir = CanonicalInputRepresentation {
version: CIR_VERSION_V3,
hash_alg: CirHashAlgorithm::Sha256,
let cir = CanonicalInputRepresentation::new_v4(
validation_time,
objects: Vec::new(),
trust_anchors: vec![CirTrustAnchor {
Vec::new(),
Vec::new(),
vec![CirTrustAnchor {
ta_rsync_uri,
tal_uri,
tal_bytes,
ta_certificate_der: ta_bytes,
ta_certificate_sha256,
}],
reject_list_sha256: compute_reject_list_sha256(std::iter::empty::<&str>()),
rejected_objects: Vec::new(),
};
Vec::new(),
Vec::new(),
);
let der = encode_cir(&cir).map_err(|e| format!("encode cir failed: {e}"))?;
if let Some(parent) = cir_out.parent() {
std::fs::create_dir_all(parent).map_err(|e| format!("create cir parent failed: {e}"))?;

61
src/bin/triage_ccr_cir_pair.rs
View File

@@ -273,23 +273,19 @@ fn build_cir_summary(args: &Args) -> Result<Value, String> {
let left = decode_cir(&read_file(&args.left_cir)?).map_err(|e| e.to_string())?;
let right = decode_cir(&read_file(&args.right_cir)?).map_err(|e| e.to_string())?;
let left_objects = left
.objects
.iter()
.validated_objects()
.map(|item| (item.rsync_uri.clone(), hex::encode(&item.sha256)))
.collect::<BTreeMap<_, _>>();
let right_objects = right
.objects
.iter()
.validated_objects()
.map(|item| (item.rsync_uri.clone(), hex::encode(&item.sha256)))
.collect::<BTreeMap<_, _>>();
let left_rejects = left
.rejected_objects
.iter()
.rejected_objects()
.map(|item| item.object_uri.clone())
.collect::<BTreeSet<_>>();
let right_rejects = right
.rejected_objects
.iter()
.rejected_objects()
.map(|item| item.object_uri.clone())
.collect::<BTreeSet<_>>();
let left_trust_anchors = left
@@ -338,15 +334,15 @@ fn build_cir_summary(args: &Args) -> Result<Value, String> {
"rejectListSha256Match": reject_hash_match,
"validationTimeMatch": validation_time_match,
"left": {
"objectCount": left.objects.len(),
"rejectCount": left.rejected_objects.len(),
"objectCount": left.validated_object_count(),
"rejectCount": left.rejected_object_count(),
"trustAnchorCount": left.trust_anchors.len(),
"rejectListSha256": hex::encode(&left.reject_list_sha256),
"validationTime": format_time(left.validation_time)?,
},
"right": {
"objectCount": right.objects.len(),
"rejectCount": right.rejected_objects.len(),
"objectCount": right.validated_object_count(),
"rejectCount": right.rejected_object_count(),
"trustAnchorCount": right.trust_anchors.len(),
"rejectListSha256": hex::encode(&right.reject_list_sha256),
"validationTime": format_time(right.validation_time)?,
@@ -977,8 +973,8 @@ mod tests {
build_aspa_payload_state, build_roa_payload_state, encode_content_info,
};
use rpki::cir::{
CIR_VERSION_V3, CanonicalInputRepresentation, CirHashAlgorithm, CirObject,
CirRejectedObject, CirTrustAnchor, compute_reject_list_sha256, encode_cir, sha256,
CanonicalInputRepresentation, CirObject, CirRejectedObject, CirTrustAnchor, encode_cir,
sha256,
};
use rpki::data_model::roa::{IpPrefix, RoaAfi};
use rpki::validation::objects::{AspaAttestation, Vrp};
@@ -1193,6 +1189,7 @@ mod tests {
codes,
vec![
"P1_TRUST_ANCHOR_DIFFERENCE",
"P2_OBJECT_URI_SET_DIFFERENCE",
"P3_OBJECT_CONTENT_HASH_DIFFERENCE",
"P4_REJECT_DECISION_DIFFERENCE",
"P5_VALIDATION_TIME_DIFFERENCE",
@@ -1392,20 +1389,30 @@ mod tests {
}]
})
.unwrap_or_default();
CanonicalInputRepresentation {
version: CIR_VERSION_V3,
hash_alg: CirHashAlgorithm::Sha256,
validation_time,
objects: vec![CirObject {
rsync_uri: "rsync://example.net/repo/a.roa".to_string(),
sha256: vec![object_hash_fill; 32],
}],
trust_anchors: vec![trust_anchor],
reject_list_sha256: compute_reject_list_sha256(
rejected_objects.iter().map(|item| item.object_uri.as_str()),
),
rejected_objects,
let mut objects = vec![CirObject {
rsync_uri: "rsync://example.net/repo/a.roa".to_string(),
sha256: vec![object_hash_fill; 32],
}];
for rejected in &rejected_objects {
if !objects
.iter()
.any(|object| object.rsync_uri == rejected.object_uri)
{
objects.push(CirObject {
rsync_uri: rejected.object_uri.clone(),
sha256: vec![object_hash_fill; 32],
});
}
}
objects.sort_by(|a, b| a.rsync_uri.cmp(&b.rsync_uri));
CanonicalInputRepresentation::new_v4(
validation_time,
objects,
Vec::new(),
vec![trust_anchor],
rejected_objects,
Vec::new(),
)
}
fn sample_trust_anchor(name: &str) -> CirTrustAnchor {