diff --git a/README.client.md b/README.client.md index 2abf00b..214d835 100644 --- a/README.client.md +++ b/README.client.md @@ -37,6 +37,14 @@ ./deploy/server/build-run.sh up --mode ssh ``` +TLS/SSH 所需的本地开发证书和密钥可以通过脚本生成： + +```bash +bash scripts/generate-certs.sh +``` + +已有 `certs/` 时使用 `--force` 覆盖。脚本生成的 `certs/tls` 和 `certs/ssh` 文件名与本仓库 compose 默认配置一致。 + Client 连接地址不要求固定在某个 Docker 网络里。`deploy/client` 的 TCP/TLS/SSH 模式分别通过 `RPKI_RTR_TCP_SERVER_ADDR`、`RPKI_RTR_TLS_SERVER_ADDR`、`RPKI_RTR_SSH_SERVER_ADDR` 指定 server 地址。`deploy/bird` 通过 `RPKI_BIRD_RPKI_HOST`/`RPKI_BIRD_RPKI_PORT` 指定 TCP server 地址，通过 `RPKI_BIRD_SSH_RPKI_HOST`/`RPKI_RTR_SSH_PORT` 指定 SSH server 地址。示例 compose 里的默认值只是为了和本仓库 server compose 直接联调。 `deploy/frr` 示例默认连接 `127.0.0.1:323`，可以通过 `RPKI_FRR_RPKI_HOST`/`RPKI_FRR_RPKI_PORT` 覆盖。 @@ -213,7 +221,7 @@ SSH 模式默认读取 `certs/ssh` 目录下的 key，并使用 `bird.conf.ssh.t | --- | --- | --- | | `RPKI_BIRD_SSH_RPKI_HOST` | `rpki-rtr` | SSH RTR server 主机名 | | `RPKI_RTR_SSH_PORT` | `22` | SSH RTR server 端口 | -| `RPKI_BIRD_SSH_CERTS_HOST_DIR` | `../../certs/ssh` | 宿主机 SSH 证书和 key 目录 | +| `RPKI_BIRD_SSH_CERTS_HOST_DIR` | `../../certs/ssh` | 宿主机 SSH 证书和 key 目录，复用 `rtr-client.key` | ## 如何判断 Client 正常 diff --git a/README.md b/README.md index b0e457a..0b40f1f 100644 --- a/README.md +++ b/README.md @@ -19,6 +19,7 @@ - [构建与测试](#构建与测试) - [数据输入](#数据输入) - [快速启动](#快速启动) + - [前置数据生成](#前置数据生成) - [Docker 运行](#docker-运行) - [跨架构构建](#跨架构构建) - [传输模式](#传输模式) @@ -77,6 +78,33 @@ cargo run --bin rpki_rtr ## 快速启动 +### 前置数据生成 + +TLS/mTLS 或 SSH transport 需要本地证书和密钥。开发和 Docker 联调可用脚本生成 compose 默认引用的最小文件集： + +```bash +bash scripts/10_generate-certs.sh +``` + +如需覆盖已有 `certs/` 内容： + +```bash +bash scripts/10_generate-certs.sh --force +``` + +`10_generate-certs.sh` 常用参数： + +| 参数 | 说明 | +| --- | --- | +| `--out-dir DIR` | 指定输出目录，默认生成到 `./certs`。 | +| `--server-dns NAME` | 指定 TLS server 证书的 dNSName SAN，默认 `localhost`。 | +| `--tls-only` | 只生成 `certs/tls` 下的 TLS 证书和私钥。 | +| `--ssh-only` | 只生成 `certs/ssh` 下的 SSH host key、client key 和 `authorized_keys`。 | +| `--force` | 覆盖已有文件。未指定时，如果目标文件已存在会直接报错退出。 | +| `-h`, `--help` | 查看脚本帮助。 | + +TLS server name 默认是 `localhost`。如果需要其它 DNS 名称，需要同时设置 `scripts/10_generate-certs.sh --server-dns ` 和 client 的 `RPKI_RTR_TLS_SERVER_NAME=`。 + ### Docker 运行 推荐使用 `deploy/server/build-run.sh` 和 `deploy/client/build-run.sh` 分别管理 server 与 debug client： diff --git a/certs/ssh/_probe_key b/certs/ssh/_probe_key deleted file mode 100644 index 61297f0..0000000 --- a/certs/ssh/_probe_key +++ /dev/null @@ -1,8 +0,0 @@ ------BEGIN OPENSSH PRIVATE KEY----- -b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABChIc/mh2 -2ZlTnDw27U26Q9AAAAGAAAAAEAAAAzAAAAC3NzaC1lZDI1NTE5AAAAIHh6RLKV3/Dd8Ku0 -PB+lLBZo6E+EXJ2WYLYjIzVU/5t9AAAAoLzKj5jOlcoxcNfmUjP4KnfUEQ0wB2dhwpmzym -p7kqtBnTd7q1VZ+tszUyOEEAwvWChWPsQ5qcFkrXlI12NJVl0bv4XHXXXCoUzTuzasQhWg -ajws+FR9McWjTwYbuxPK8nZlRMGKVv3KTEb7IKzPiB1/+XVKRQCVyzhfJCFJTSIwL66KbP -knSamwB5g59wp8xcjPmdecqba6a7wTeHy21cg= ------END OPENSSH PRIVATE KEY----- diff --git a/certs/ssh/_probe_key.pub b/certs/ssh/_probe_key.pub deleted file mode 100644 index 2267478..0000000 --- a/certs/ssh/_probe_key.pub +++ /dev/null @@ -1 +0,0 @@ -ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHh6RLKV3/Dd8Ku0PB+lLBZo6E+EXJ2WYLYjIzVU/5t9 xuxiuting@LAPTOP-A2IH6TNR diff --git a/certs/ssh/bird-rtr-client-rsa.pem b/certs/ssh/bird-rtr-client-rsa.pem deleted file mode 100644 index c190cd3..0000000 --- a/certs/ssh/bird-rtr-client-rsa.pem +++ /dev/null @@ -1,39 +0,0 @@ ------BEGIN RSA PRIVATE KEY----- -MIIG4wIBAAKCAYEAvA91otbecwZFtDiZcV2m/A8RP9C+r1DmaDi/1tBaqleNRt3W -UCdMPEF5NGCBWq/52tWwL3rBXEEp0gcEHYoTZ5djAlAjLaQphbFGQU/h3WWDEVOl -GFnGCc4DP26SRp/oC01QpOlgT9Z/m2xkMZGhZo9oR2v7+ARmF9Qrxlj9HjuDWmZI -Onl5DGXmbI0sBOs1PMtOvmU2aJNKVU3hD335Z0J9c5NubuQQtS/vl0XJQYgbCMh9 -4BlbEBppJ6LyzcILbUAfayl2U9sQGErf9CjkwOuITpRBO+f10BQSpGjznRYCX4Yf -71lhH1ri6lOKhupOW1wgC6kkQTcvI9hub1ePLtmOiWUCfnrc2eZljNssqKWYC9+5 -v9Ya6+aikSlOheUoMJP1C50PTMnMqRfNGLn3yFKTT/CaQBw1TMO/+Rfsb80Oj9O3 -yF9zCHTFrUsYn9T2tupRi/aYWfLe3ckqTBLLhSWLfiY9S49U/fdP5Sk8l4JsAyxE -9oH6RokJIrZxR09pAgMBAAECggGABSIjOvtEWLLwjFC+3YGUg+JcZ+0d22FpB1TE -kHZLrJqAXybB3sUSghLjyP/OYB2YGMwG8mYr04XC1g++IhlJWiVKJ6oXf7uGAkx6 -Z2DTwJbwsDR5N/QxYUX36uTCMOkqAhmi7HwjVnfmL/r83tPZFO3ase0QacQi+PO1 -cIVa1BcEnknW9GOpn81DRYNyqBK3N2OG+3r99HZQITUjl32VOnyYjzhUcMn1wSBf -w6BnyTZleISn159m5TEMsu8yKKwrLDNe5pyXjLk1HpU8fDo/CoDq+i4KJ2V2Ns4j -+zg2EMqW1EQNI/BYDtOYlL+m5dGEST50Oqq7OiopvchKjIkvgFr+08vlyCyjbryv -DF5B6VEkk1iEacDKK/NyHdjXPmGBvlEeBixOOpS5dBb6m0KPx9C9jTi/tTRBnH4t -7qAko/LoYfBgjyRqDyqeUKrvVp/3NOmkQefaHttr9abhotjmtGqAvJfN1VfFY5e1 -s6Ga7yJno5tyS7RArw3OA6t2n2S1AoHBAN8mMuuZQL5xNY2bpn5O9u19QaoG3rRR -Ma6nEO2QPxM+hB8QR2fYAZwgHr38B+keodf/Xe02Xkf+urd2t+eHpoMbzZeEopaM -hNDEo1mYaIl0lgQLy1RzpvfV0B+gy808FOut6YDESyJ4sxGuP3E7CIn+QfFh9Uht -6I/ZyDfM87Q2LlP8ES/EecHfVO97l1gOJ5T9j1bnTTVgM4zJqAWiqlLyUcS56sos -7NPZbYF81ViR4BI/3rthtoUUY8hoSmfXFQKBwQDXvt8oC3Inmr729nrsZCb72fbG -8T9DieUW8MCAwvv4c1DEA2aATgLpidH+NJJyCsR7Ph05AvcSpiUgyF25TeTliBZu -YUaUDE8JuTFTEcjkqpPj62MX8C8J3DjN0TG0fI1ltousef+Ind64Fdh2kPKl2YfE -F/95pc+/y0VbXl8rcQyYCQuo+4ooBIbq1BhprzKC6Tdg2HsvCYrz3EzOJHHD/iLZ -jlHjXAeKo0MjVyDRDy3ollxDg7a1ESGwewVGrAUCgcEAkyeLmNY9XdkmKbYlO1Iz -gDWDoe5Z2qtYigZeIWtoTPaDBkEj9ZT6qsx7uWmEhfTPYbNja1TZI70VwHqnmCVa -Z0dkcrDiz0jnJQ0nc6QP++VIMG7erVh/GRyE3Paar0MZwLm1LFdF/Pt/iv9PkwoM -/YMQVW/14sen/4Tshe/AHm1Ea9nkM43rhTATwMHN8iGTdKspZXOu9K32ELfC98Rn -cb+esI6yCJVLsADIOAXsYzX/f8lixksPo/7oNnaf6o5pAoHAcxBooknge0DsAnkY -vET6Ca6JEDeQfyvnU+HZOZNEoZCXDcOmgl2Y7gdESSiuxkX53qUVHtf3ACo+eQqD -+hWSM9zt4bbd1o3uBYiQxvYgR9y1/YQIGLdPzxl17kdZFCKtowbF3Zo/cBSKuXFl -Pm82CsBGyY3nAnEtqOP3vLBLX7bueZOxdVGasJchgdLWpl77OJi7oVoz8LVNN5xS -FkuXpWlAGvntsK3fk9BZOVr5tKY83OR8lsGDy3Q0nJQwDy4lAoHAOqqDBGbV9oMZ -kBMnntl9FNE8h/UoprFEQKEAsU5Vbx7hrPkLGmgO6pWQceFPYXTdu2u8ictWCBoP -aogdoEsD59A6XHQ28OqMuf41njNc6E6kVBoFq9j9+for8EQsx5iH6Azd+rV67hxW -esLGn7H+P55t5s7/KgPOn2fZI4cHScvEJxNZMqqoUsq488by0Obf0qYmwpKh3HE3 -1wybZj9ZTTFTDwqpyrWBUF2BLf/LGlalcrbbiYIHa1L8i5Gy6u6y ------END RSA PRIVATE KEY----- diff --git a/certs/ssh/bird-rtr-client-rsa.pem.pub b/certs/ssh/bird-rtr-client-rsa.pem.pub deleted file mode 100644 index cff53f4..0000000 Binary files a/certs/ssh/bird-rtr-client-rsa.pem.pub and /dev/null differ diff --git a/certs/ssh/bird-rtr-client.key b/certs/ssh/bird-rtr-client.key deleted file mode 100644 index df4fbac..0000000 --- a/certs/ssh/bird-rtr-client.key +++ /dev/null @@ -1,39 +0,0 @@ ------BEGIN OPENSSH PRIVATE KEY----- -b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABAaTeJ0Al -IMgPHrgsaVr3RlAAAAGAAAAAEAAAGXAAAAB3NzaC1yc2EAAAADAQABAAABgQDQGmbM6oQ3 -HYuaghpNTbIfOQQqC7m0vX5dUqcDlhlMyntyHAQOCzV8M5jbr2REeyTw60XXEezvb05mRm -4NKQXJGsBR+/n5ZgvxpSFfso9ZBTTflEwBgBSQdoz/abWXe2inJ1MATu2An1vIAERQO/Gv -V9HYcLgF3sZ9T6X6yvVUt5TKWaQ2wNKQb3KNTpnBzrK74gkUaDj1HUt/DeVk42L80boycK -Zq2/jkHb4U6ThRXof7NJzgpHMgtMbCwAsN68fY4iIIN1046TIGHwy0sJaYrRDVzpWFLRS+ -hc68g5MWbhtiUFGGVjjMkUbSwegorB6hRxEyMYjn1bhLuUhiMVJkF552Y4Dwu7D1zRd4qk -6ZL3nlEOCNsLTo+HIFCP0XUodaWdx2WJKZlpUpjzN7JF3MXqY0/xEgLNlL/SLSB1tod1PW -fKfF7WDYluZJNCPv3V4296vcpG/VNBVew6ODRFT1WTQhVPenJLHuxZrOTg3sbGMXrsY8Lh -JjQtVTY4ijvRkAAAWQANIwKXD3+y7RY6XFUvYSm6PGQbgfWO7NNR20whNld5pAHWzSamI5 -hNil50ZlYqfrfcZ8Gfhc3i9Td7ATd2h7ZBMTmkKMOzssTldTuKg13dc0r+Nk80o6PyT4SR -YyHRVEk2Y9IeEtwjFaR50VlVY+qmLx6dzgN0tDDdb0Nenb4g1qkIjgepLu6b2KH1wznZGM -feJPHQwfPi3RYnUquFnpfdOLdseDQS7EVLfoK/jg5lMjxGMXgptN00fOH6M2oEYaDbQK6S -GnROKBUu5mBFPDgidahwlIkaBJ7/HAiTFhQLo75AZSEDPOOveGkW+0DJPlqw1f5a4k2jRQ -1+wNbceuj5Zm9uw1EPzZpEQ42+DaQK3Ze5aRdm/AovykLwdmk29LK5WiGgyfsYZILq3UOB -IBAq+Mg/ePgoQDH6raQnPvwO4+2cKmMhBFu4Ck+af8fPyRfMYvjFSxxDE7kUoSuWUb1WRP -ZK95yf0BrUd8E6LqVp9476UuvrkG9wm8HMlI5Q+uksQ5tZPHCNGzIOKgDP1V7RsTWlYX9n -2eJqfUq1zgP2sfVUrLehxCn9uLHBzzjIq/RPQIhBFNnT8RgBRBGm6Q+LrhkkDCsA3hzuys -9ja+cypw6uSxGe6Q7l832PEggKaMJy54ZExosVOdXi8vxJgKSzhIuWSjIslHBPv4A1L4vd -9heimddR6Lm1eIqzyen0y45oHDcbj4+R9vSUd4LH4jT24EzsAU7SY8Y+qLhRk67AZqx+z8 -3w3pHnMJNzfo4RUn261LhkyXbr5Tgk9EUBaSTjRkBgRwXDuf5AJ7lgCzEfxaQl24Fe7Q9m -ufvfk5uiL9dNXWOCYk9zvdbLVLA8c0pyB+wKKOCWDJlaJpkwSNbch1JO5Sk+mTXrRDll3m -xGK9ARaKfAH5+oRVqHS+5I4tBwFLG+DQL7ktj0YRvu+c1spVzFiiwf4MkOe1Hs/EmQfKEP -BWUq1uAZhVDS2TeUQwkjR5//eGkSMvE4d9HJnTQTDZk07kv1FvpJ271MWXrln94c/tvKuh -9Ef34IkMFG6O9uJ2Uu7/U5FSyGuyfeg/7Rffl4jnPDaJnjA0I8QMpjiqckkXIzSP2k0ZtP -WodpqzBUeRKeJiawkf5kVa0cW0Fq+pW7dlO9b38ufpgcuiV/EadlsVY3qfBhDOpdiGwAob -ER9pW4Z6Bnl+8ci1U3f7P8PrNiYGm1g8wTgNYCrOSU1JuLoI1y//OZT9u7gpXwsrazjcWU -hrTXQje273IiB/yosJrtqhJkmAKYDrgb45Pe0a2J0voIHY5jsF7MNlFlJb/zVZvBn8vWpA -QYXKnq0Agx97UMwyKaYvm/v0UTJZgS1Jd5owY1jwwGubBIt58VRfX6++EJ3QY+EslYvCN0 -BzBV4B+a8WhuGsF7x6Rlv8ei1+hEW3FFHsL4KBjy0e38yvVkYHlND+oxBvawxsikdNwL/2 -g4LfKSVEysjbRSd+UVqVYlBLnmfio7E7sbShp7TgmV7BBsE+9N1PEKRX02QUlhXYqLensx -3vhOrFcEGvdji8qYAnxK0aGLuMwG/czHjD7tD6xUjjzxVLv9qY9pHX9WxRxYDNyoSX65lj -EbqpcPe4QrDypTvNKEeZ4w0FEsYP4J0O6ZDXuBoQnSqsbFkvEP3lCf0ezq8jfJn5K0BBkH -auJpHWx9g8+U+3vKMj4+00fHtp8v0hMMCOzGy8Ol2yS5x6z3Or0HkYzbcMMZvkUNk+z47c -bHFgdUC/lqc9UrhleAWwkEc9l3qoA61nz7B2jAmZhlNBKFPiIZn2TG7xy4CITDV46j+j92 -y8/hyJDEB0yxx2O/zZKhkEf/N/bAlhIo/8dsjMCMBgE0X+sdpQCfZ+k/dQnAlvWRYhLrkr -tO97CdjmrFG+AR8pwNqjvJnH9fw= ------END OPENSSH PRIVATE KEY----- diff --git a/certs/ssh/bird-rtr-client.key.pub b/certs/ssh/bird-rtr-client.key.pub deleted file mode 100644 index 868327c..0000000 --- a/certs/ssh/bird-rtr-client.key.pub +++ /dev/null @@ -1 +0,0 @@ -ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDQGmbM6oQ3HYuaghpNTbIfOQQqC7m0vX5dUqcDlhlMyntyHAQOCzV8M5jbr2REeyTw60XXEezvb05mRm4NKQXJGsBR+/n5ZgvxpSFfso9ZBTTflEwBgBSQdoz/abWXe2inJ1MATu2An1vIAERQO/GvV9HYcLgF3sZ9T6X6yvVUt5TKWaQ2wNKQb3KNTpnBzrK74gkUaDj1HUt/DeVk42L80boycKZq2/jkHb4U6ThRXof7NJzgpHMgtMbCwAsN68fY4iIIN1046TIGHwy0sJaYrRDVzpWFLRS+hc68g5MWbhtiUFGGVjjMkUbSwegorB6hRxEyMYjn1bhLuUhiMVJkF552Y4Dwu7D1zRd4qk6ZL3nlEOCNsLTo+HIFCP0XUodaWdx2WJKZlpUpjzN7JF3MXqY0/xEgLNlL/SLSB1tod1PWfKfF7WDYluZJNCPv3V4296vcpG/VNBVew6ODRFT1WTQhVPenJLHuxZrOTg3sbGMXrsY8LhJjQtVTY4ijvRk= bird-rtr-client diff --git a/certs/ssh/bird-rtr-client.pem b/certs/ssh/bird-rtr-client.pem deleted file mode 100644 index 0218f4c..0000000 --- a/certs/ssh/bird-rtr-client.pem +++ /dev/null @@ -1,40 +0,0 @@ ------BEGIN PRIVATE KEY----- -MIIG/QIBADANBgkqhkiG9w0BAQEFAASCBucwggbjAgEAAoIBgQC9gxH/EK68bxW8 -dKY/cTV54Ek4VV2lCMv9pcrSwi4w2tg1Vu4uMYizyWxkRpT3gI5NexNu/d2riAvT -LFEJTuD2eaCWa4PuuVpKVNvCjhAXYhu+E0X0QZj3iDdmtSQioEGcYBzvFeADjp8R -/JMv8RTDZVEuIZGSS5e7xmZQ45CvWBcrD9EstaOX3oA9reYm3ucE2wHGS8tEXFLi -k3qh52l3trKY0b+Hkd26P7BreoELPegQK/Cek9KJBtp9rRvRuOuzx5VixnLIgyz9 -TII+1O3x3c3hHullKQ3DSl6CDHpNnujPetvPbldIwUR1GfkjG/AxKjHtc2yZ915X -fFi/qaMc6ehmPKO+t3geEjcL6W4sArzs8xkYs204daz1f9/CLtpJVBhsUNkhoz1l -RbnaqZr8LuwjlujX3te0UltX3u7D00gKUwRZHw8GE1ksIO2USvZaTggscBykJzq7 -oG6FvrNy/L8htHWEzDlJZKDUriR6ZxaufcRwK3RFGx0307NQCVECAwEAAQKCAYAG -uKo33As8fOqeEFuQmrbpM4yZQkLT3n3gqUOKKc+qVSqvqp2ANyrIaJuO62dvZ0h0 -xEmWSUv2QFkeBF9752eoajwpNZc8bWe/xOZ17iSxNZ4zBbs4jGaM2fCQFJrbXQhy -r8B69NFJAwMOh+EfBUuFmhdw3cksUYDITMM2eXm5VFQfB3y1W5xZn6838M3dwVBb -flp/4lKLYkRgy5cA/MSDdc/8Bk1nFSPybf2XdET1JX0QbMSIFUlVaZAwfqYi0C6B -RH9xpiihYlgwbVtElMsIqh3ExgB3OlhjliYacWQvxhi5fRJdUT5TYiTpCmaIsg1C -GWXtZADClrzL2rdvkrVUo4KHg1jSc/sxh/LaN061JdGuDxs2O0mg1CzwmWeCG8xy -0BWPzNruUDM30IV6klMW2vZvYMiDZqjN+fW0qiP3NYgqNBPQLBoW2Jh3Xy9jYsaV -AisxEzGRDXNOsTvKhcxPOV+0APyhZdVB70pbZwO13iWhjZqZWYrUAqkYsLlnhAEC -gcEA4r3pdzKeBpGR5Y6htmhW3U0Vi5hiKBBa3PZALebsk0W9VIumPRB7H3D+Ydmh -/alEQV7QBFojfA5LFmHqJ0Wf35zZ7r7oQv4aowY6ppLexjGeqolAxeMmXluSQjOd -gnOaVcWjEeyvtV1M2/7rmLAzWPlbCemByJRWHWjRBc1UU+yXG+zRHzvOwStzdfLB -YG12RAXa+fyHLm5544HnVJ3kzhlAK5QAJ+yqBp3lUingbUvV4fMmlMD+P9SBnDiO -4WtRAoHBANX3Uv7vwERx/Xho1+9v3iotTRYgJKsMRJraWs+4nR17WpT9kiBugKMg -6PKaTOuk3ylPZIWji9KCEX7qkrA4ME1pkELG0A9GQXaSE7MCLQzZxOkMBQeMdiSe -GgJhNtyyuL7rzLfkoAWm+xEFknv7rCaKxGaD6Be2Fmk+vSYgkUxsaVf+egRNM6L7 -4V1kpeyBf4FLOX3odwx0zON1eCvYc6sa4BoibRZx0YGhvE0Elze7QUXGzbd+3zId -2+46hyE+AQKBwQDY0p6E26R9x4pqqEA/u/sE2Ie329pRUYJyNhEdU+v60P/B72Di -l/YFFPpM+96KQOkCUfY9kyzHnqtzFeLh9xRwsv877NcR6QfzySsgyuW5RQ3jKikE -krjIFm0AXXdLndyCFOJha6KCnlu3LEiC1Evl012ZVvBCrIbEzMzE7ZqsPlwp2gYI -BhsqYbCho6gD2+jyF19VGoTyg7aPNlPOeMapxz+z7G1RwGC+vxLhxSXVnmVDEk9c -hEkdJMtkZjlLmmECgcBqBltnHrCcegvLDdDqwflJ1xbavuTMqZCZV1gmlGmugUCa -kahGT9uIejdUeCdjoVg/5Sp/mlIf5vn6dQxpK/6rbYLhxBi3aO3pbms6ifp+4q5T -ePRJEE4+yOVEhp2j8R/g44GXIkA1bM/+WE+FBmoA00SNNBHfJgim8ELUUNEPGK1+ -wAgAd6z9t2iuWcBqmKTxEbCUdov/bSVWFRCOUXzHrdKcwLBjrdTOMrHXTE4OfMjU -ZbXsln7NG8SuoOvzCgECgcAjE6ZtIW1bnbCzGOCLzbVw4AxeLuKMhwxF26k04JBJ -Yo1+vPw1skQYxelNxShHb1oUK2BsrRSYMVjKGg/rdFWng+vHWl2Ff2hj1pI0Pn5d -n8/vLTDKf0SrRXXNDK+rB70TUqis8zvLb8EACuvlL0YHiAtcWFC9GT9XQMmFbyn1 -PI14Wbzk+0TYs1UQ9FNd4IWL8IbDxxCzFGAUs2g+nYXuRQv/1juZGfsUXlrQZG9O -qD4S5Fez6uDBzHtzJjKizWw= ------END PRIVATE KEY----- diff --git a/certs/ssh/bird-rtr-client.pem.pub b/certs/ssh/bird-rtr-client.pem.pub deleted file mode 100644 index def71f6..0000000 Binary files a/certs/ssh/bird-rtr-client.pem.pub and /dev/null differ diff --git a/certs/ssh/rtr-authorized_keys b/certs/ssh/rtr-authorized_keys deleted file mode 100644 index b490159..0000000 --- a/certs/ssh/rtr-authorized_keys +++ /dev/null @@ -1,5 +0,0 @@ -ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC9MkggFr9ic5Ply9tPzsldgut9WAb0bgdDomFtBezDC4rzi/8vWUhzZv+lezWnyKYnMPHe80FEZ8+5QrNjS2GV6KMDxQZN7Wr4Lzh+eQv3hcT+TG6CUa7KjXvuq8P6UYGW9LCn8d36YGmxXkbEtUJlmA2dRemx6xlrpXavCaXLgTph+3eoe2mWTMukwHjzuu4PXhElfCFGZnTMXAkjimCfrH+11YMb1NpMosm/8H8aYZZGAkGPljKAjOLPwAXgn77hoIlRKlslesCmTBJCnmyp/0raIXAW3nkuMnkW9ORdt1Ti7yXsRv+flFBhFh7hM9SfqgbMAkDem1TugDTFTBRkiesh2Y+sQbgk0YO2T5PF+NVLZuuTssog3JyMbRYADZGjzdnvVSG4ICR+1fVehelOnMo1tgSsk3M8WkM5wgfn5HATYcBXaiHo97Q0CHzGKI4KrOqvTc4Bb/uh0VQIecpQajGuZqsWDlxkwk1hd1/s84Qo6kk/iZWKk+S+8uXlHRc= xuxiuting@LAPTOP-A2IH6TNR -ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC9gxH/EK68bxW8dKY/cTV54Ek4VV2lCMv9pcrSwi4w2tg1Vu4uMYizyWxkRpT3gI5NexNu/d2riAvTLFEJTuD2eaCWa4PuuVpKVNvCjhAXYhu+E0X0QZj3iDdmtSQioEGcYBzvFeADjp8R/JMv8RTDZVEuIZGSS5e7xmZQ45CvWBcrD9EstaOX3oA9reYm3ucE2wHGS8tEXFLik3qh52l3trKY0b+Hkd26P7BreoELPegQK/Cek9KJBtp9rRvRuOuzx5VixnLIgyz9TII+1O3x3c3hHullKQ3DSl6CDHpNnujPetvPbldIwUR1GfkjG/AxKjHtc2yZ915XfFi/qaMc6ehmPKO+t3geEjcL6W4sArzs8xkYs204daz1f9/CLtpJVBhsUNkhoz1lRbnaqZr8LuwjlujX3te0UltX3u7D00gKUwRZHw8GE1ksIO2USvZaTggscBykJzq7oG6FvrNy/L8htHWEzDlJZKDUriR6ZxaufcRwK3RFGx0307NQCVE= - -ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC8D3Wi1t5zBkW0OJlxXab8DxE/0L6vUOZoOL/W0FqqV41G3dZQJ0w8QXk0YIFar/na1bAvesFcQSnSBwQdihNnl2MCUCMtpCmFsUZBT+HdZYMRU6UYWcYJzgM/bpJGn+gLTVCk6WBP1n+bbGQxkaFmj2hHa/v4BGYX1CvGWP0eO4NaZkg6eXkMZeZsjSwE6zU8y06+ZTZok0pVTeEPfflnQn1zk25u5BC1L++XRclBiBsIyH3gGVsQGmknovLNwgttQB9rKXZT2xAYSt/0KOTA64hOlEE75/XQFBKkaPOdFgJfhh/vWWEfWuLqU4qG6k5bXCALqSRBNy8j2G5vV48u2Y6JZQJ+etzZ5mWM2yyopZgL37m/1hrr5qKRKU6F5Sgwk/ULnQ9MycypF80YuffIUpNP8JpAHDVMw7/5F+xvzQ6P07fIX3MIdMWtSxif1Pa26lGL9phZ8t7dySpMEsuFJYt+Jj1Lj1T990/lKTyXgmwDLET2gfpGiQkitnFHT2k= - diff --git a/certs/ssh/rtr-client.key b/certs/ssh/rtr-client.key deleted file mode 100644 index 7b646a1..0000000 --- a/certs/ssh/rtr-client.key +++ /dev/null @@ -1,38 +0,0 @@ ------BEGIN OPENSSH PRIVATE KEY----- -b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn -NhAAAAAwEAAQAAAYEAvTJIIBa/YnOT5cvbT87JXYLrfVgG9G4HQ6JhbQXswwuK84v/L1lI -c2b/pXs1p8imJzDx3vNBRGfPuUKzY0thleijA8UGTe1q+C84fnkL94XE/kxuglGuyo177q -vD+lGBlvSwp/Hd+mBpsV5GxLVCZZgNnUXpsesZa6V2rwmly4E6Yft3qHtplkzLpMB487ru -D14RJXwhRmZ0zFwJI4pgn6x/tdWDG9TaTKLJv/B/GmGWRgJBj5YygIziz8AF4J++4aCJUS -pbJXrApkwSQp5sqf9K2iFwFt55LjJ5FvTkXbdU4u8l7Eb/n5RQYRYe4TPUn6oGzAJA3ptU -7oA0xUwUZInrIdmPrEG4JNGDtk+TxfjVS2brk7LKINycjG0WAA2Ro83Z71UhuCAkftX1Xo -XpTpzKNbYErJNzPFpDOcIH5+RwE2HAV2oh6Pe0NAh8xiiOCqzqr03OAW/7odFUCHnKUGox -rmarFg5cZMJNYXdf7POEKOpJP4mVipPkvvLl5R0XAAAFkHgpYu14KWLtAAAAB3NzaC1yc2 -EAAAGBAL0ySCAWv2Jzk+XL20/OyV2C631YBvRuB0OiYW0F7MMLivOL/y9ZSHNm/6V7NafI -picw8d7zQURnz7lCs2NLYZXoowPFBk3tavgvOH55C/eFxP5MboJRrsqNe+6rw/pRgZb0sK -fx3fpgabFeRsS1QmWYDZ1F6bHrGWuldq8JpcuBOmH7d6h7aZZMy6TAePO67g9eESV8IUZm -dMxcCSOKYJ+sf7XVgxvU2kyiyb/wfxphlkYCQY+WMoCM4s/ABeCfvuGgiVEqWyV6wKZMEk -KebKn/StohcBbeeS4yeRb05F23VOLvJexG/5+UUGEWHuEz1J+qBswCQN6bVO6ANMVMFGSJ -6yHZj6xBuCTRg7ZPk8X41Utm65OyyiDcnIxtFgANkaPN2e9VIbggJH7V9V6F6U6cyjW2BK -yTczxaQznCB+fkcBNhwFdqIej3tDQIfMYojgqs6q9NzgFv+6HRVAh5ylBqMa5mqxYOXGTC -TWF3X+zzhCjqST+JlYqT5L7y5eUdFwAAAAMBAAEAAAGAPmfEdJksPZwj74tjZpqtvuN9K5 -YKjTtxt/RqsFxg8SDwj07hOEv54t7Zekr+sr4zWAAD9+dC4v5e/RusMhdeM+VNR+QIJVIn -k3934fepY9bC2KJ7XQ72Wad7dok/lmSmGxXQ40SbVIfStQeEzkN/iCU0cGjsIZyLgP9N+4 -RyJIMWr9UTbgZvGH1yOoCmJLbG6Vi8zSF5lFAdPH8rIIb3QhPS+DZaDacS7m5Pn7kDI7+G -oscBuwvu0oomEiKjjakC6xcI1pcH/qNjP1LVhiS6qtERQLAfKGeAQiM44lsqK018fRazMf -UujVvlafZ/92o+SEwh4e5+oS6rY+aLHoeslGN+BxEsHpyyszl3w4hRRR9XQK9Te/pWGWer -fFRiJLNlkd0pkYJguT9xTdiDC5KMyJeUhNrdcOn1Df1o3T3uqdZIaFfiGUKsruOovSIgwG -iYAKCb7b3zHfWDorP2g0Ckd87DKC3J8C6vXKJd/EO2ex+EkJWammeUwdW4mExniY+RAAAA -wD2jFsuvpecZ/MB89WG7uMVJP7eoBJrPKYfODUR1YHkxUwmEqC1jaIR07qP6EaI5P58vaG -ai7Hdp7SXidn0zeGAUFZCw8TyA9UsHWshk1ydJkspuch22VBOzgmAe2A7Rw317yqL7if9I -zYOs7ce9Epnr+qSjNCD1oRw88kwKOLxV19ty3pfp/nhu4TKzzZDJChL/h9/ZQ02ED9l6KS -ZnX/7C/f8lPMfWxJGshLJnhXvNB6wbAF06/wIRlA9IT0XFWgAAAMEA3aZyJel9M+flKiAD -sruAfbx39zpJSpizA5rI+y8UFmD4bQ7gwAnHY9+8kzQhFjLSXQ+np5T8mvCii7uxh9j406 -je2/UD5ZS7vmwcC+MoqCxvNL0kVF9FdoNmejUWqZ59Ig9p48AxVe2jG3+Rea1X45C45/1X -FucDsf5i5Nf7lAqEhM2vIuyKEWu8BSkMY84E4RTtt5S55BcGqritsUYJn/QP4DNzBo9WQd -61qg7Ve5rMEtSq+UV/Aj4x7qMbBI0PAAAAwQDahEsvkMwQuhHAPfPnn+580SuQ7KwIMyZY -BtFnIEvQfWKBU1c5kcHoeIPFZ5Bql2aVbL2AuRl+MGRoZ8wYK/rqUytjeRi0aq0IQgH8WW -PK4bL1RbHwZdyEMc/6CbAA5pd7bFQKopEmf0Md2QC2M/nwS4TAVDDQepdCzQJ9W+EzJI+L -fvJdihyB1psCLkCd7elGGnBbbTqUjAPNJJio8wZUdD/f1ZEd4KKw1joX/+c4FoLdXlpVci -dO+ciUfrz8f3kAAAAZeHV4aXV0aW5nQExBUFRPUC1BMklINlROUgEC ------END OPENSSH PRIVATE KEY----- diff --git a/certs/ssh/rtr-client.key.pub b/certs/ssh/rtr-client.key.pub deleted file mode 100644 index 065826d..0000000 --- a/certs/ssh/rtr-client.key.pub +++ /dev/null @@ -1 +0,0 @@ -ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC9MkggFr9ic5Ply9tPzsldgut9WAb0bgdDomFtBezDC4rzi/8vWUhzZv+lezWnyKYnMPHe80FEZ8+5QrNjS2GV6KMDxQZN7Wr4Lzh+eQv3hcT+TG6CUa7KjXvuq8P6UYGW9LCn8d36YGmxXkbEtUJlmA2dRemx6xlrpXavCaXLgTph+3eoe2mWTMukwHjzuu4PXhElfCFGZnTMXAkjimCfrH+11YMb1NpMosm/8H8aYZZGAkGPljKAjOLPwAXgn77hoIlRKlslesCmTBJCnmyp/0raIXAW3nkuMnkW9ORdt1Ti7yXsRv+flFBhFh7hM9SfqgbMAkDem1TugDTFTBRkiesh2Y+sQbgk0YO2T5PF+NVLZuuTssog3JyMbRYADZGjzdnvVSG4ICR+1fVehelOnMo1tgSsk3M8WkM5wgfn5HATYcBXaiHo97Q0CHzGKI4KrOqvTc4Bb/uh0VQIecpQajGuZqsWDlxkwk1hd1/s84Qo6kk/iZWKk+S+8uXlHRc= xuxiuting@LAPTOP-A2IH6TNR diff --git a/certs/ssh/rtr-client.pem b/certs/ssh/rtr-client.pem deleted file mode 100644 index 7b646a1..0000000 --- a/certs/ssh/rtr-client.pem +++ /dev/null @@ -1,38 +0,0 @@ ------BEGIN OPENSSH PRIVATE KEY----- -b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn -NhAAAAAwEAAQAAAYEAvTJIIBa/YnOT5cvbT87JXYLrfVgG9G4HQ6JhbQXswwuK84v/L1lI -c2b/pXs1p8imJzDx3vNBRGfPuUKzY0thleijA8UGTe1q+C84fnkL94XE/kxuglGuyo177q -vD+lGBlvSwp/Hd+mBpsV5GxLVCZZgNnUXpsesZa6V2rwmly4E6Yft3qHtplkzLpMB487ru -D14RJXwhRmZ0zFwJI4pgn6x/tdWDG9TaTKLJv/B/GmGWRgJBj5YygIziz8AF4J++4aCJUS -pbJXrApkwSQp5sqf9K2iFwFt55LjJ5FvTkXbdU4u8l7Eb/n5RQYRYe4TPUn6oGzAJA3ptU -7oA0xUwUZInrIdmPrEG4JNGDtk+TxfjVS2brk7LKINycjG0WAA2Ro83Z71UhuCAkftX1Xo -XpTpzKNbYErJNzPFpDOcIH5+RwE2HAV2oh6Pe0NAh8xiiOCqzqr03OAW/7odFUCHnKUGox -rmarFg5cZMJNYXdf7POEKOpJP4mVipPkvvLl5R0XAAAFkHgpYu14KWLtAAAAB3NzaC1yc2 -EAAAGBAL0ySCAWv2Jzk+XL20/OyV2C631YBvRuB0OiYW0F7MMLivOL/y9ZSHNm/6V7NafI -picw8d7zQURnz7lCs2NLYZXoowPFBk3tavgvOH55C/eFxP5MboJRrsqNe+6rw/pRgZb0sK -fx3fpgabFeRsS1QmWYDZ1F6bHrGWuldq8JpcuBOmH7d6h7aZZMy6TAePO67g9eESV8IUZm -dMxcCSOKYJ+sf7XVgxvU2kyiyb/wfxphlkYCQY+WMoCM4s/ABeCfvuGgiVEqWyV6wKZMEk -KebKn/StohcBbeeS4yeRb05F23VOLvJexG/5+UUGEWHuEz1J+qBswCQN6bVO6ANMVMFGSJ -6yHZj6xBuCTRg7ZPk8X41Utm65OyyiDcnIxtFgANkaPN2e9VIbggJH7V9V6F6U6cyjW2BK -yTczxaQznCB+fkcBNhwFdqIej3tDQIfMYojgqs6q9NzgFv+6HRVAh5ylBqMa5mqxYOXGTC -TWF3X+zzhCjqST+JlYqT5L7y5eUdFwAAAAMBAAEAAAGAPmfEdJksPZwj74tjZpqtvuN9K5 -YKjTtxt/RqsFxg8SDwj07hOEv54t7Zekr+sr4zWAAD9+dC4v5e/RusMhdeM+VNR+QIJVIn -k3934fepY9bC2KJ7XQ72Wad7dok/lmSmGxXQ40SbVIfStQeEzkN/iCU0cGjsIZyLgP9N+4 -RyJIMWr9UTbgZvGH1yOoCmJLbG6Vi8zSF5lFAdPH8rIIb3QhPS+DZaDacS7m5Pn7kDI7+G -oscBuwvu0oomEiKjjakC6xcI1pcH/qNjP1LVhiS6qtERQLAfKGeAQiM44lsqK018fRazMf -UujVvlafZ/92o+SEwh4e5+oS6rY+aLHoeslGN+BxEsHpyyszl3w4hRRR9XQK9Te/pWGWer -fFRiJLNlkd0pkYJguT9xTdiDC5KMyJeUhNrdcOn1Df1o3T3uqdZIaFfiGUKsruOovSIgwG -iYAKCb7b3zHfWDorP2g0Ckd87DKC3J8C6vXKJd/EO2ex+EkJWammeUwdW4mExniY+RAAAA -wD2jFsuvpecZ/MB89WG7uMVJP7eoBJrPKYfODUR1YHkxUwmEqC1jaIR07qP6EaI5P58vaG -ai7Hdp7SXidn0zeGAUFZCw8TyA9UsHWshk1ydJkspuch22VBOzgmAe2A7Rw317yqL7if9I -zYOs7ce9Epnr+qSjNCD1oRw88kwKOLxV19ty3pfp/nhu4TKzzZDJChL/h9/ZQ02ED9l6KS -ZnX/7C/f8lPMfWxJGshLJnhXvNB6wbAF06/wIRlA9IT0XFWgAAAMEA3aZyJel9M+flKiAD -sruAfbx39zpJSpizA5rI+y8UFmD4bQ7gwAnHY9+8kzQhFjLSXQ+np5T8mvCii7uxh9j406 -je2/UD5ZS7vmwcC+MoqCxvNL0kVF9FdoNmejUWqZ59Ig9p48AxVe2jG3+Rea1X45C45/1X -FucDsf5i5Nf7lAqEhM2vIuyKEWu8BSkMY84E4RTtt5S55BcGqritsUYJn/QP4DNzBo9WQd -61qg7Ve5rMEtSq+UV/Aj4x7qMbBI0PAAAAwQDahEsvkMwQuhHAPfPnn+580SuQ7KwIMyZY -BtFnIEvQfWKBU1c5kcHoeIPFZ5Bql2aVbL2AuRl+MGRoZ8wYK/rqUytjeRi0aq0IQgH8WW -PK4bL1RbHwZdyEMc/6CbAA5pd7bFQKopEmf0Md2QC2M/nwS4TAVDDQepdCzQJ9W+EzJI+L -fvJdihyB1psCLkCd7elGGnBbbTqUjAPNJJio8wZUdD/f1ZEd4KKw1joX/+c4FoLdXlpVci -dO+ciUfrz8f3kAAAAZeHV4aXV0aW5nQExBUFRPUC1BMklINlROUgEC ------END OPENSSH PRIVATE KEY----- diff --git a/certs/ssh/ssh_host_rsa_key b/certs/ssh/ssh_host_rsa_key deleted file mode 100644 index 9656090..0000000 --- a/certs/ssh/ssh_host_rsa_key +++ /dev/null @@ -1,38 +0,0 @@ ------BEGIN OPENSSH PRIVATE KEY----- -b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn -NhAAAAAwEAAQAAAYEA08poqyD9GeB7YdNabpl6cFff3yHu7/E6usvW9/BY05HjYVDWSUCB -tLLI+1Z2w00/8BuOKECZ8ExSfMWyMHWDQWc2wXL8ZYZPQjzqOCWXNsNt9DXMin7DGS3Lg4 -DCssl3m3cMMRkQcaKlGbdOLMJayt3ABHf+lovRK8D9U6eGACsX4+F7zoSb5lhNauIrH329 -sxKq5HF8nKgQECivc4zvsUBdFXxSak3nNRmA+Sc58IwBf8liv+exWYHUCrh/Y3Q7s8pE5e -xvPdbkpESk2ze7sIarZ5E3q4FYZP7w6Mc/BJ9BVz+YmkIVcDtm0wwGMFL56bfx2l87GgZR -mHjWV+6vnXC6ikH3KJI+yCqhiL1rUoaVgWCpHsUsF6ZHlZP9Go0QH3ZAo0pDGnqxJJPZa2 -zUOaF6xxF3IUOtZ/oMZGNqX+WuiXKuqTMLcL7NcT+WQXYk1zRcHW9CJ8XmCl4xSymEA7kI -7ObGwJ1Vfi/ocIUjgtMxdYOWaGYAuFp0aY4/nv3tAAAFkKmSKaOpkimjAAAAB3NzaC1yc2 -EAAAGBANPKaKsg/Rnge2HTWm6ZenBX398h7u/xOrrL1vfwWNOR42FQ1klAgbSyyPtWdsNN -P/AbjihAmfBMUnzFsjB1g0FnNsFy/GWGT0I86jgllzbDbfQ1zIp+wxkty4OAwrLJd5t3DD -EZEHGipRm3TizCWsrdwAR3/paL0SvA/VOnhgArF+Phe86Em+ZYTWriKx99vbMSquRxfJyo -EBAor3OM77FAXRV8UmpN5zUZgPknOfCMAX/JYr/nsVmB1Aq4f2N0O7PKROXsbz3W5KREpN -s3u7CGq2eRN6uBWGT+8OjHPwSfQVc/mJpCFXA7ZtMMBjBS+em38dpfOxoGUZh41lfur51w -uopB9yiSPsgqoYi9a1KGlYFgqR7FLBemR5WT/RqNEB92QKNKQxp6sSST2Wts1DmhescRdy -FDrWf6DGRjal/lrolyrqkzC3C+zXE/lkF2JNc0XB1vQifF5gpeMUsphAO5COzmxsCdVX4v -6HCFI4LTMXWDlmhmALhadGmOP5797QAAAAMBAAEAAAGARE9apyeCux/ua8URu+6A0U9mg7 -+cI4P431rzwRCidcruPesm0oWd0DyCGp7uu1tlLfqVRWJgxGK5kEjrijm81hGGVarSwaQq -WEDxgp6NQTqTclsP1/O+1ZYxt/6FzcixbVFee0+MQDqnab331vPw+NHBJy/Uy5XZJ3Wdv6 -eeztsXX4bQufGHnyoH/ltocUXLM8DnobsA6D5EwBF/VZO1k8QgwddRdbwewL+zG6mNRIrD -yQWZdjAywZ3gWHzdiaRpLtwIqqVq6q+2nphu41sJTKbU9ZrDLz4YZ4eawPloeukTq+mChS -UyYK4gomNUG1RugeQNiGW1SG/fDMMVWzYDxmnKxBrVvv/J1AHhyQbScjDjGLxo9aG5A2XJ -8kfZbkgTsfUP0IhmOFOK2KlRiZDuSGBNGgrEWxzpA/G4T5WGzBDT2pvW6yn5BQDCzpMwy6 -sNiB3cdWNHGyy4Gu/c2Owljb0RukXsfkFN5oaj4fXo2E+Yymm7qTUuPVDgay3/W1cBAAAA -wEL4j23iXytSSR5U5x0XvVKobDwM+SgOJ1OKhm9FsXmPBDnT/3FzNJ6dZNVYYPtM5Pbal5 -J6soTlHwsHvEJxakrH0B9WqKAhShpJ/pC3UIpxaHAWQ5bk9Z3mBfwSargUFUZDz+hoCEFR -ZwdSU9LI8vK/nk4urhxMi7BjAHh/acRo5AoOVk9zDTq4FhvwtQG0P6HKZoHLcLKh7Hxm0e -OPhiWwfXt5TQSgAI4kIKy3UOwxFgsNsI5JLFMWuZ8KUdFCaQAAAMEA8+cTAauvEmDHlg+D -1KtlbxT96lN2RRruvRO/VxAomP8ZLPV4/9EpS6oTYaWve1TibD1HgJ5k22BBBGOAbEuhz2 -jBxIL2JaGUNmWR1Tofe7s+VY/AKbepwBmTxelyIhbhAcXToFjUIS3398+bxbiSYEU3hmAA -EmeHui5kZYRcU3Lxv24qfdc9tjaAm3i4OIlhv+QPteJRWB54pdVuYaIZDsSp9mC4BzVNmN -hJiJ4gB+JEigfp30200Q69soM4umnNAAAAwQDeS5i0cChxeppZ3RbOecZuNE3t09L18nFv -h8KBXQ/UBt/Z6ElUWME/YATJ4eNUp+/VzyhxmMDzt3yG+k182qe6on4Q73MGgZ+l2mc6TL -sgN/WoqT0H0P7N3QFqvIsKqH4zHcQFYwx6sgEvCppI7dWP1xkBedjXw6hL7j3poXp+lfT3 -XVGt1J6hMvgXUiyl+xAHjXnH7qU1oTw6Bn/O8hWylFBXSzzdVGjI+NYAzg4vAB+XecJx4V -gOi7X82F9oRKEAAAAZeHV4aXV0aW5nQExBUFRPUC1BMklINlROUgEC ------END OPENSSH PRIVATE KEY----- diff --git a/certs/ssh/ssh_host_rsa_key.pub b/certs/ssh/ssh_host_rsa_key.pub deleted file mode 100644 index a3e7657..0000000 --- a/certs/ssh/ssh_host_rsa_key.pub +++ /dev/null @@ -1 +0,0 @@ -ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDTymirIP0Z4Hth01pumXpwV9/fIe7v8Tq6y9b38FjTkeNhUNZJQIG0ssj7VnbDTT/wG44oQJnwTFJ8xbIwdYNBZzbBcvxlhk9CPOo4JZc2w230NcyKfsMZLcuDgMKyyXebdwwxGRBxoqUZt04swlrK3cAEd/6Wi9ErwP1Tp4YAKxfj4XvOhJvmWE1q4isffb2zEqrkcXycqBAQKK9zjO+xQF0VfFJqTec1GYD5JznwjAF/yWK/57FZgdQKuH9jdDuzykTl7G891uSkRKTbN7uwhqtnkTergVhk/vDoxz8En0FXP5iaQhVwO2bTDAYwUvnpt/HaXzsaBlGYeNZX7q+dcLqKQfcokj7IKqGIvWtShpWBYKkexSwXpkeVk/0ajRAfdkCjSkMaerEkk9lrbNQ5oXrHEXchQ61n+gxkY2pf5a6Jcq6pMwtwvs1xP5ZBdiTXNFwdb0InxeYKXjFLKYQDuQjs5sbAnVV+L+hwhSOC0zF1g5ZoZgC4WnRpjj+e/e0= xuxiuting@LAPTOP-A2IH6TNR diff --git a/certs/ssh/ssh_known_hosts b/certs/ssh/ssh_known_hosts deleted file mode 100644 index 2bf2602..0000000 --- a/certs/ssh/ssh_known_hosts +++ /dev/null @@ -1,2 +0,0 @@ -host.docker.internal ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDTymirIP0Z4Hth01pumXpwV9/fIe7v8Tq6y9b38FjTkeNhUNZJQIG0ssj7VnbDTT/wG44oQJnwTFJ8xbIwdYNBZzbBcvxlhk9CPOo4JZc2w230NcyKfsMZLcuDgMKyyXebdwwxGRBxoqUZt04swlrK3cAEd/6Wi9ErwP1Tp4YAKxfj4XvOhJvmWE1q4isffb2zEqrkcXycqBAQKK9zjO+xQF0VfFJqTec1GYD5JznwjAF/yWK/57FZgdQKuH9jdDuzykTl7G891uSkRKTbN7uwhqtnkTergVhk/vDoxz8En0FXP5iaQhVwO2bTDAYwUvnpt/HaXzsaBlGYeNZX7q+dcLqKQfcokj7IKqGIvWtShpWBYKkexSwXpkeVk/0ajRAfdkCjSkMaerEkk9lrbNQ5oXrHEXchQ61n+gxkY2pf5a6Jcq6pMwtwvs1xP5ZBdiTXNFwdb0InxeYKXjFLKYQDuQjs5sbAnVV+L+hwhSOC0zF1g5ZoZgC4WnRpjj+e/e0= -[host.docker.internal]:22 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDTymirIP0Z4Hth01pumXpwV9/fIe7v8Tq6y9b38FjTkeNhUNZJQIG0ssj7VnbDTT/wG44oQJnwTFJ8xbIwdYNBZzbBcvxlhk9CPOo4JZc2w230NcyKfsMZLcuDgMKyyXebdwwxGRBxoqUZt04swlrK3cAEd/6Wi9ErwP1Tp4YAKxfj4XvOhJvmWE1q4isffb2zEqrkcXycqBAQKK9zjO+xQF0VfFJqTec1GYD5JznwjAF/yWK/57FZgdQKuH9jdDuzykTl7G891uSkRKTbN7uwhqtnkTergVhk/vDoxz8En0FXP5iaQhVwO2bTDAYwUvnpt/HaXzsaBlGYeNZX7q+dcLqKQfcokj7IKqGIvWtShpWBYKkexSwXpkeVk/0ajRAfdkCjSkMaerEkk9lrbNQ5oXrHEXchQ61n+gxkY2pf5a6Jcq6pMwtwvs1xP5ZBdiTXNFwdb0InxeYKXjFLKYQDuQjs5sbAnVV+L+hwhSOC0zF1g5ZoZgC4WnRpjj+e/e0= diff --git a/certs/ssh/testkey b/certs/ssh/testkey deleted file mode 100644 index 38685db..0000000 --- a/certs/ssh/testkey +++ /dev/null @@ -1,8 +0,0 @@ ------BEGIN OPENSSH PRIVATE KEY----- -b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABAo7qsNAU -RiW+8UlbN+a34gAAAAGAAAAAEAAAAzAAAAC3NzaC1lZDI1NTE5AAAAIMSj2JT9F+tcY/IA -/qQda0zzC5B768tkm4JwwBHI/dtnAAAAoEVxoJY8k0yGG43sZ9YchTOlEiVpSF3rw0i1Ce -lqjCx5RrtYMMmnZCIw4oo4kp6ATlluqGoR58BkJPhTW4i/pGH7sqJHltFNhFAu2VMNOlhp -Eu5WDTotsDpDX7J5A9Lmc5zMdCvoRr+FUd314N7N/5GV4yyUiXlunMFbtgt6QBzYvakqqv -pIWhsfz3mBe+oenAFpXkrdkQe6Jsy88ZVwVyI= ------END OPENSSH PRIVATE KEY----- diff --git a/certs/ssh/testkey.pub b/certs/ssh/testkey.pub deleted file mode 100644 index 585d967..0000000 --- a/certs/ssh/testkey.pub +++ /dev/null @@ -1 +0,0 @@ -ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMSj2JT9F+tcY/IA/qQda0zzC5B768tkm4JwwBHI/dtn xuxiuting@LAPTOP-A2IH6TNR diff --git a/certs/ssh/testkey3 b/certs/ssh/testkey3 deleted file mode 100644 index adfa38d..0000000 --- a/certs/ssh/testkey3 +++ /dev/null @@ -1,8 +0,0 @@ ------BEGIN OPENSSH PRIVATE KEY----- -b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABACsU5bHT -9Ps+FePAk6wYjzAAAAGAAAAAEAAAAzAAAAC3NzaC1lZDI1NTE5AAAAIADxGbVl4d3SirJF -LBUz7CnzNZMWCDc9iL8BmxjIYGpNAAAAoPryTWyd3TszwaRBXRTGSxvAKW8Um9VYdphhFr -CkePw369/VBarJJmRqUO6lPG3WfCyVG3N3yW+05Y0dVy53G885GWEoQQoy93Q3JY6dfQa4 -soxlJSROPz/I0X30gq/p5jR6WFHCWUcEZ61BkHhUW8c1R9vtmlBdsTbtbhJWczeKrbyj+p -UcFxN6YEoXl39c9GbCCyd785cgTof4rmEDvQ0= ------END OPENSSH PRIVATE KEY----- diff --git a/certs/ssh/testkey3.pub b/certs/ssh/testkey3.pub deleted file mode 100644 index 9fb8b46..0000000 --- a/certs/ssh/testkey3.pub +++ /dev/null @@ -1 +0,0 @@ -ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIADxGbVl4d3SirJFLBUz7CnzNZMWCDc9iL8BmxjIYGpN xuxiuting@LAPTOP-A2IH6TNR diff --git a/certs/tls/client-ca.crt b/certs/tls/client-ca.crt deleted file mode 100644 index 5094787..0000000 --- a/certs/tls/client-ca.crt +++ /dev/null @@ -1,19 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIDGzCCAgOgAwIBAgIUKCaM+eEU12YVn/tC6MEBYPj50oIwDQYJKoZIhvcNAQEL -BQAwHTEbMBkGA1UEAwwSUlRSIFRlc3QgQ2xpZW50IENBMB4XDTI2MDMyMzA4MDQy -OFoXDTM2MDMyMDA4MDQyOFowHTEbMBkGA1UEAwwSUlRSIFRlc3QgQ2xpZW50IENB -MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmmS+gsRZXPaG20Ra2te7 -WVeqyeFX2lV/RvNsT3WW+EtwuTN2aFJ/pBgSCqgCaFocU5IcgfScybQrjmTWeEot -D0F1OOW/TihlBsrU3BS8vOZ4KTuwB9eOgpt7FL8CxLetjNWxZKBsvJMauOUYFLCt -DN+78EDqrZ2VyJPfa+7dJKS/JoRgs/WFjvAeb5x1UpKPf/gp1Ji+Vj92Ux9znYF1 -2Zfs77NsLdwcqyMVj7cb1nucutNf/vMqNi+BoSwC/tQkflda9bLUwto/ZfFPsCFw -Ptjwiwm+IGNAKG8r1ujaUVDtxc+NliuAbHERBgZGtYpAE6u28+d8cUAyGGQFNGqb -uQIDAQABo1MwUTAdBgNVHQ4EFgQUtiTCqdhd2TwFc7JZGWkF8BEcMJwwHwYDVR0j -BBgwFoAUtiTCqdhd2TwFc7JZGWkF8BEcMJwwDwYDVR0TAQH/BAUwAwEB/zANBgkq -hkiG9w0BAQsFAAOCAQEATr0wChmDvmw51RQ0kOFP1l3n+O1n/U0xR39YApnmdhtk -MyO9gNyqxdUWj4QaRkswr5iMyjsLrT3lYWGfh7oHlhIgkXEy5OK548rhj/PA6d5U -M7DDGI06EFfYXcC57Cx1y8Egd9gfkfPk0ned/TG+/dYtyb7sBiIKrOiDExbfZ53U -mNtfsdptBoOjee4KggplfVhkUopyO0KKD7twq4dvWgzWZHv7m5wrQA8GP8W4JpPP -ZAs8cOLfq4cxAwYFXEaf0x7is2u9KdagPqXkiPMeC8fOHWyRCR7sKN4Dnh57ruqq -mQXil9GGFfkDA/bh6+Rs93Yll7yYyA3xif6fSBmgUg== ------END CERTIFICATE----- diff --git a/certs/tls/client-good.crt b/certs/tls/client-good.crt deleted file mode 100644 index 9f4e2ff..0000000 --- a/certs/tls/client-good.crt +++ /dev/null @@ -1,20 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIDMjCCAhqgAwIBAgIUTLfIortKKjsYovPDuDVnUR8i2YMwDQYJKoZIhvcNAQEL -BQAwHTEbMBkGA1UEAwwSUlRSIFRlc3QgQ2xpZW50IENBMB4XDTI2MDMyMzA4MDUw -MFoXDTM2MDMyMDA4MDUwMFowHzEdMBsGA1UEAwwUUlRSIFRlc3QgQ2xpZW50IEdv -b2QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDUjnhxQxKUNLjGN6mu -/VvoGXfsyvZq38QMlfIauGPQ5Jwpq2BU2gW1zFvjBJaS8ZKY2DOsBKvZMrEiSxVt -8WCCgvSucw5Elwniq/Yu8UmkvWEMnk9oXwQuHQeWYSe2eMvwBMTNaj3Vz+xo2Ga/ -+eGClxPDcKKvOMYz+BRpyMfHzX1LLrM26yDjyxQKxzsrFMQ5IKXkhv4COLAjpLZd -oEDSkG+W4fbGTC6bSkskFP62OmnR/Qq6dXBVAJkzHqoiWEmKWBQy9JhEo+N3Jz7D -QfOAI/20MD6J4brWS56ciHL67yQjHJW6P0HlcLzefFqspIwvTFyCsF137jJi9sqL -y7UlAgMBAAGjaDBmMA8GA1UdEQQIMAaHBH8AAAEwEwYDVR0lBAwwCgYIKwYBBQUH -AwIwHQYDVR0OBBYEFJy0O+AR5EdWrUr2UHtPCUVTrRiEMB8GA1UdIwQYMBaAFLYk -wqnYXdk8BXOyWRlpBfARHDCcMA0GCSqGSIb3DQEBCwUAA4IBAQB8eavz/Pk3oJBh -sgy4ve6nLAqKGcD+zSoBxw/ErZaDNdUZZaFKT9nypfi39jkfjU+CIfhczCs5Cknk -EDqYtp1BXkY+auKeYRkoaCKv+ucnIc6JZ70NOQGdDNzU4eb9tVA9Py0j5VzvxWR1 -yl6vHTc3tTA873RRezvUe+SQDwR+x2dxZ0O0MFZR4CTaTeR+fpD4bE9mBcYN1KVk -HdA7USCwOZ0qE+aHTegM4pgGrpHYS5yBpUFADqfJl1yBnnqc10zkphoy6dRsbVuN -NkDostGbbfGdGjEPs6i1TMsDTVyOo4nsHACk4q4m/IEVBkiMwxmwyhK1EEWQmQpy -h0CqAs3Z ------END CERTIFICATE----- diff --git a/certs/tls/client-good.key b/certs/tls/client-good.key deleted file mode 100644 index 07bada9..0000000 --- a/certs/tls/client-good.key +++ /dev/null @@ -1,28 +0,0 @@ ------BEGIN PRIVATE KEY----- -MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDUjnhxQxKUNLjG -N6mu/VvoGXfsyvZq38QMlfIauGPQ5Jwpq2BU2gW1zFvjBJaS8ZKY2DOsBKvZMrEi -SxVt8WCCgvSucw5Elwniq/Yu8UmkvWEMnk9oXwQuHQeWYSe2eMvwBMTNaj3Vz+xo -2Ga/+eGClxPDcKKvOMYz+BRpyMfHzX1LLrM26yDjyxQKxzsrFMQ5IKXkhv4COLAj -pLZdoEDSkG+W4fbGTC6bSkskFP62OmnR/Qq6dXBVAJkzHqoiWEmKWBQy9JhEo+N3 -Jz7DQfOAI/20MD6J4brWS56ciHL67yQjHJW6P0HlcLzefFqspIwvTFyCsF137jJi -9sqLy7UlAgMBAAECggEALmsOkm17WTJKR79QJw7dS0qEjgmk1qIXRkhYns01vyCt -mcv7NYyHQrRmPKV73Is04HwWjLJYdQ5E8KBFBcV4tgezN4WY0BHL7txu3sGCu58/ -2mmYHcriNs/QIF8HNSocH0ZrVBCngFHv5tWbWsFPJh2oCz5FyM41OpQqoQ9f0ZoA -PKq3m7dNidFmlQPhhJ9KeLYwDfzTRy4sWBDrgZFDQ6ut9nO8/JpJvxZCSnOdbW1T -6pYk3uAKKcmrcdI2fsg7u0J1zkrkDnRdrDv1QCY/h1UXvR4KuMeYRylHWJpOKUiR -asxpJO+lh7TmDaEIqO+dSmTHawcKDYuIp0EV4/x7AQKBgQD/cgMhx97bJ3ym0ucc -xtt10jo0NTW7SJIXx/eUdBQNA3aGWfsqLrBI5qKrXLxTXF/vAs3LWHiHF6EgRxW/ -7RbO+NZzAGxg53Y3PMqZ4AQbOm2JCIgT9ZhQc55+qowdtrts3njL+ayy3vWh3nPt -G78+rs4ZLCHhEutbkKqU7S3XSQKBgQDVBJ5l9d1QcqFqYnlmyhgfwJwpxo4N2dJR -18pCow8Mp8S9ROJx3OF4yNTRa6ipnX0oGdgchT63jXBDoKot3/4tqbjYj/Y3MmKL -crZ7dZEiAqkqE975qUfSlQS6BtknRKduzQzAJAKz0A+JbPIisPHIrBnG2PH9h2XA -TjA2rHRi/QKBgDIp65+IpqUW/g2swSIPky1yGWgDQwgCWl49MMuAeCeOFIqRxRcl -kAzg7fUFAx7Dtzsyq8NRHmo5I7U5AHZuUtpWV5bB8IafLcHvOEI7kdLfCH+uozp4 -Mm8qJWfuihGTvv7EOaik4VtHGamuC8n2dvoSTfr3hbezhXC32ifg4+2xAoGATbjp -snoKzheFHbPgZ8jFFJDKadOwcQ1Q19vMSJQGIa/08Ln5hWH6Qn/EZsTJPVnhGIiV -eZKEV6SbmZE9ho97xl1uvFWKmIkhu4+XVWSIF8iwwFGPwbgqJIOKvfVRtioujRbz -2AdLlSANCy9dCZtWHMnufccaRE7qqUfd/5TcwmECgYA5md1JZ+p+0yTkjNf4McCe -mpZiXXaM8uC3/XiWlfcw3ag88H0XCqt2UPcX03MC9ZzywfTdoEHhPRfr48uRiH7K -Pi1T8E2E0GkSfk6zh6wJm8Kmm9+VJd2rUFrb35xDMUfjpS228oH9UBQtwaAV+jmy -q/APoG+aWt5YIeYElx9mzA== ------END PRIVATE KEY----- diff --git a/certs/tls/server-dns.crt b/certs/tls/server-dns.crt deleted file mode 100644 index 4f8be31..0000000 --- a/certs/tls/server-dns.crt +++ /dev/null @@ -1,19 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIDLDCCAhSgAwIBAgIUU9TJAAXI1pavsowFKFye0t8gdz4wDQYJKoZIhvcNAQEL -BQAwHTEbMBkGA1UEAwwSUlRSIFRlc3QgQ2xpZW50IENBMB4XDTI2MDMyNDAyMzA0 -N1oXDTM2MDMyMTAyMzA0N1owFDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkq -hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzXLZ2ZeySuuzCDEPXsHMym0py7Tuwizu -5a4AKQt+7d8b51x22W+I6ZQXYOCUml+C0PGs5TfQDXs0VbYj08flVxw9732FPqzp -PhkZJlEbnu7+nEW4mb+aM+pnPnW7iLeCvePGXicYO9YctQNA9Onxe+63QtEi2OtO -24wlqreToA2qQ7UOeNbpcY5p9psgXt9wW+8rq1gXmKsci8DV//1MessDTTX4tgIh -lOvKBIqx2E2kIIbZ6BwB7veKCkwqrFeVKzmwCXfkVQZkyfxKTBOvf3VFssnFJ7Ld -dYuAMTpl9jCHkNykGNlc0a9ohglEvAjqwgpUdMcuzMMR8Kf0DjqZqwIDAQABo20w -azAUBgNVHREEDTALgglsb2NhbGhvc3QwEwYDVR0lBAwwCgYIKwYBBQUHAwEwHQYD -VR0OBBYEFOYSmMCX8XUYA9jMGY2M1v5/xaimMB8GA1UdIwQYMBaAFLYkwqnYXdk8 -BXOyWRlpBfARHDCcMA0GCSqGSIb3DQEBCwUAA4IBAQArYXsdMl+vPyTyv/oRzCo0 -mWyVO3RZPPRJSrrMz4UjtVMIfq6pnV+AXPEcWL/zEfQNcRPjsJeezkG66AZbI+ug -fur90YVDhWfOgde4E3cVhZz90aM/jcRMVvwNj0XiaX4JpxsVhv5T4LC80aXm0r02 -YfJyqwtNaZlKDntaW56q7nD5eaoqmYa+ogpdqwCIfGvManfRH6v6xmzgQRKnD1lc -LZPDZ9dmkQg2N/vdZfVUpB2+EZYF/9BuIvJyGKNYBjJiQGv2kbaFUl13mw7D/yGP -Zytpu5AIPl6ScYog8x6dSJMiYM+hO1bD9qOU0Kq48PaLQoQ4poYo7zdbiB8TZaKC ------END CERTIFICATE----- diff --git a/certs/tls/server-dns.key b/certs/tls/server-dns.key deleted file mode 100644 index 09247a4..0000000 --- a/certs/tls/server-dns.key +++ /dev/null @@ -1,28 +0,0 @@ ------BEGIN PRIVATE KEY----- -MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDNctnZl7JK67MI -MQ9ewczKbSnLtO7CLO7lrgApC37t3xvnXHbZb4jplBdg4JSaX4LQ8azlN9ANezRV -tiPTx+VXHD3vfYU+rOk+GRkmURue7v6cRbiZv5oz6mc+dbuIt4K948ZeJxg71hy1 -A0D06fF77rdC0SLY607bjCWqt5OgDapDtQ541ulxjmn2myBe33Bb7yurWBeYqxyL -wNX//Ux6ywNNNfi2AiGU68oEirHYTaQghtnoHAHu94oKTCqsV5UrObAJd+RVBmTJ -/EpME69/dUWyycUnst11i4AxOmX2MIeQ3KQY2VzRr2iGCUS8COrCClR0xy7MwxHw -p/QOOpmrAgMBAAECggEAKOWyBCS0c0GUNA9AFgbSM4Gjjk+IL9MuAz6t/X2yWLvP -HDFF32bahFTcioZqToiwy9MwLbj8i5J5Co7lduUV/E887Q25lo5pJ9lrLjt7GhpN -SOKAKur/UVJaFw7ss/yD5DURafCyXEb1E/t/1ME1NwyAIqbrHu9IlV/Cp8c/dd6n -BUZHKN38Fs8riUOTW4BwAA1dV0k+g8bKb0byR5WmXbXqWG/XjfUKcI4Dg9ILsTwG -QgI/nzRyAV2unVcdNhM4pMTJ4U4x1Dh/rsWyQ4b206namkpfaIH7j8ovRY2OHhzT -EuCbn1Cpfmxp68hRrvMIhLvqVkXOSWzKOkHZba/qYQKBgQD0m3WJu5UHXip14gY/ -SmDm3vEcFjVZa+BmQtojs32ZfT/b1H5U+mfhXlVi0yf7B7nitQ9zOA7A2C8cxdtr -X9zd81MHLc7yUEOAlHBqSfBX/DyF1iRsdM7GYYxrsaECM7NIDukDR1Q/DvMZodRx -iVpRkNP3s87a1/QwvDKrwOPcCQKBgQDXBH1IZWcl1mrGgfAI7r5wXIJo0IrTlUcT -4nFSNv5YnrhnRzmLDRqxwlUs4II87nzsqv7OYryAg4n8us+X6XQv0hvTKcHsM7tl -vAO2EeQIER71tEg45HhmAXo2X2bE5kNMTr4COlb8k6R6r5K2F4yVMZim4qPcMYAK -tNRXf9JdEwKBgQDEjpOxvPmxdPrbxWfNvgAGJYpMTpBKLgShSAEwhRBdoacKCEQI -FzwYfoxQoGtVLk0yHtqudJJuZondLiT2sI60D85dS3MrhlHn5eA7mPS4Tyl3Rq/4 -Mxjhkwuakp9WPKNJOSoHB29sSKASrdcf8QaR2rZqKqQDeVtxOhnhqFuxuQKBgHrk -8/53BteXj/vZtKpGWs658UebOl3oinGREZgeGo3oWhmdmgQh/0nueuRlhcrxvLFA -otavlHIXvLyYwaJgKqpSetjcmxw4DTn+llhwLVd3Aa0J1+W8oBwdaA6/xGtx+LEa -qHt5gNJoSLBevYoaN53mdQudqm5mVHrKFDvWsRPFAoGBALAkJiXM4y+aTcwREjnO -CgebDRru37mprDW2PDa4vpTydxIcXZukTEZqXbVnXNDY/Gkyv06jYoY2R7mzbgfl -7RJIFAQffkzoeFadQZqimIAN3sQ6RRzNqmAlS2D6zjylX7N2rDiPcS3LtrJZHEyk -gTFx7+6gjfPNqPiAB5su0IJm ------END PRIVATE KEY----- diff --git a/deploy/bird/README.md b/deploy/bird/README.md index 761bf41..8229e78 100644 --- a/deploy/bird/README.md +++ b/deploy/bird/README.md @@ -83,7 +83,7 @@ docker logs -f bird-rpki-client `OBSERVE_INTERVAL` (seconds, used when `OBSERVE_MODE=interval`), and `OBSERVE_PROTO`. - SSH mode mounts `../../certs/ssh` into `/config/ssh` and expects: - `bird-rtr-client.pem` and `ssh_host_rsa_key.pub`. + `rtr-client.key` and `ssh_host_rsa_key.pub`. - Entrypoint auto-generates `/run/bird/known_hosts` from `/config/ssh/ssh_host_rsa_key.pub` for BIRD SSH host-key verification. - If your environment does not support Docker host networking, switch to a diff --git a/deploy/bird/README.zh.md b/deploy/bird/README.zh.md index a012158..d7c754b 100644 --- a/deploy/bird/README.zh.md +++ b/deploy/bird/README.zh.md @@ -74,7 +74,7 @@ docker logs -f bird-rpki-client - 当前 compose 使用 `network_mode: host`，默认通过 `host.docker.internal` 访问 server。 - 观测频率由环境变量控制：`OBSERVE_INTERVAL`（秒，默认 `30`）和 `OBSERVE_PROTO`。 - SSH 模式会将 `../../certs/ssh` 挂载到容器 `/config/ssh`，并使用： - `bird-rtr-client.pem`、`ssh_host_rsa_key.pub`。 + `rtr-client.key`、`ssh_host_rsa_key.pub`。 - 入口脚本会基于 `/config/ssh/ssh_host_rsa_key.pub` 自动生成 `/run/bird/known_hosts`，用于 BIRD 的 SSH 主机密钥校验。 - 如果你运行在 Docker Desktop（非 Linux 原生 host network 场景），建议改为自定义 bridge 网络并将 `remote` 地址改成可达的 server 容器名或宿主机地址。 diff --git a/deploy/bird/_debug_ssh.conf b/deploy/bird/_debug_ssh.conf index d540aca..bedb3fc 100644 --- a/deploy/bird/_debug_ssh.conf +++ b/deploy/bird/_debug_ssh.conf @@ -25,7 +25,7 @@ protocol rpki rpki_ssh { transport ssh { user "rpki-rtr"; - bird private key "/config/ssh/bird-rtr-client-rsa.pem"; + bird private key "/config/ssh/rtr-client.key"; remote public key "/run/bird/known_hosts"; }; } diff --git a/deploy/bird/bird.conf.ssh.example b/deploy/bird/bird.conf.ssh.example index e6facff..5f168ab 100644 --- a/deploy/bird/bird.conf.ssh.example +++ b/deploy/bird/bird.conf.ssh.example @@ -24,7 +24,7 @@ protocol rpki rpki_ssh { transport ssh { user "rpki-rtr"; - bird private key "/config/ssh/bird-rtr-client-rsa.pem"; + bird private key "/config/ssh/rtr-client.key"; remote public key "/run/bird/known_hosts"; }; } diff --git a/deploy/bird/bird.conf.ssh.template b/deploy/bird/bird.conf.ssh.template index 8fafaf0..46b1bea 100644 --- a/deploy/bird/bird.conf.ssh.template +++ b/deploy/bird/bird.conf.ssh.template @@ -24,7 +24,7 @@ protocol rpki rpki_ssh { transport ssh { user "rpki-rtr"; - bird private key "/config/ssh/bird-rtr-client-rsa.pem"; + bird private key "/config/ssh/rtr-client.key"; remote public key "/run/bird/known_hosts"; }; } diff --git a/deploy/client/.env b/deploy/client/.env index acaa354..4954c67 100644 --- a/deploy/client/.env +++ b/deploy/client/.env @@ -1,4 +1,7 @@ # Target RTR server addresses for client compose files +# RPKI_RTR_CLIENT_IMAGE=rpki-rtr-debug-client-arm64:v1.2 +RPKI_RTR_CLIENT_IMAGE=rpki-rtr-debug-client-amd64:v1.2 + # TCP example: 10.0.0.12:323 # TLS example: rpki.example.com:324 # SSH example: 10.0.0.12:22 diff --git a/deploy/server/.env b/deploy/server/.env index aeb492f..d516e18 100644 --- a/deploy/server/.env +++ b/deploy/server/.env @@ -1,3 +1,7 @@ +# Core runtime knobs. +# RPKI_RTR_SERVER_IMAGE=rpki-rtr-arm64:v1.2 +RPKI_RTR_SERVER_IMAGE=rpki-rtr-amd64:v1.2 + # Data source directories on host. RPKI_RTR_CCR_HOST_DIR=../../data RPKI_RTR_SLURM_HOST_DIR=../../data @@ -11,7 +15,6 @@ RPKI_RTR_REPORT_HOST_DIR=../../report RPKI_RTR_DB_PATH=/app/rtr-db RPKI_RTR_REPORT_DIR=/app/report -# Core runtime knobs. # Persistent directories on host. RPKI_RTR_DB_HOST_DIR=../../rtr-db RPKI_RTR_LOG_HOST_DIR=../../logs/server diff --git a/scripts/00_0_install.sh b/scripts/00_0_install.sh new file mode 100644 index 0000000..2d0b536 --- /dev/null +++ b/scripts/00_0_install.sh @@ -0,0 +1,203 @@ +#!/usr/bin/env bash +set -euo pipefail + +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +ROOT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)" +IMAGE_DIR="${ROOT_DIR}/images" +SERVER_ENV_FILE="${ROOT_DIR}/deploy/server/.env" +CONSOLE_ENV_FILE="${ROOT_DIR}/deploy/console/.env" + +SERVER_TAR="${RPKI_RTR_SERVER_IMAGE_TAR:-}" +CLIENT_TAR="${RPKI_RTR_CLIENT_IMAGE_TAR:-}" +CONSOLE_TAR="${RPKI_RTR_CONSOLE_IMAGE_TAR:-}" + +usage() { + cat <<'EOF' +Usage: scripts/00_0_install.sh [options] + +Load offline Docker image tarballs from ./images, then run scripts/00_1_pre_check.sh. + +Options: + --server-tar FILE Server image tarball. Env: RPKI_RTR_SERVER_IMAGE_TAR + --client-tar FILE Debug client image tarball. Env: RPKI_RTR_CLIENT_IMAGE_TAR + --console-tar FILE Console image tarball. Env: RPKI_RTR_CONSOLE_IMAGE_TAR + -h, --help Show this help. + +Default tarballs under ./images: + server: rpki-rtr-*.tar, excluding rpki-rtr-debug-client-*.tar + client: rpki-rtr-debug-client-*.tar + console: rpki-console-ui-*.tar +EOF +} + +log() { + printf '[00_install] %s\n' "$*" >&2 +} + +stage() { + printf '\n====== %s ======\n' "$*" >&2 +} + +die() { + printf '[00_install] ERROR: %s\n' "$*" >&2 + exit 1 +} + +set_env_var() { + local env_file="$1" + local key="$2" + local value="$3" + local tmp_file + + [ -f "${env_file}" ] || die "env file not found: ${env_file}" + tmp_file="${env_file}.tmp.$$" + + awk -v key="${key}" -v value="${value}" ' + BEGIN { done = 0 } + $0 ~ "^[[:space:]]*#?[[:space:]]*" key "=" { + if (!done) { + print key "=" value + done = 1 + } + next + } + { print } + END { + if (!done) { + print key "=" value + } + } + ' "${env_file}" >"${tmp_file}" + mv "${tmp_file}" "${env_file}" +} + +while [ "$#" -gt 0 ]; do + case "$1" in + --server-tar) + [ "$#" -ge 2 ] || die "--server-tar requires a value" + SERVER_TAR="$2" + shift 2 + ;; + --client-tar) + [ "$#" -ge 2 ] || die "--client-tar requires a value" + CLIENT_TAR="$2" + shift 2 + ;; + --console-tar) + [ "$#" -ge 2 ] || die "--console-tar requires a value" + CONSOLE_TAR="$2" + shift 2 + ;; + -h|--help) + usage + exit 0 + ;; + *) + die "unknown option: $1" + ;; + esac +done + +resolve_tar() { + local path="$1" + + if [ -f "${path}" ]; then + cd "$(dirname "${path}")" && printf '%s/%s\n' "$(pwd -P)" "$(basename "${path}")" + return 0 + fi + + if [ -f "${ROOT_DIR}/${path}" ]; then + cd "$(dirname "${ROOT_DIR}/${path}")" && printf '%s/%s\n' "$(pwd -P)" "$(basename "${path}")" + return 0 + fi + + return 1 +} + +load_image() { + local label="$1" + local tar_path="$2" + local output image + + [ -f "${tar_path}" ] || die "${label} image tarball not found: ${tar_path}" + output="$(docker load -i "${tar_path}" 2>&1)" || { + printf '%s\n' "${output}" >&2 + die "failed to load ${label} image from ${tar_path}" + } + printf '%s\n' "${output}" >&2 + + image="$(printf '%s\n' "${output}" | sed -n 's/^Loaded image: //p' | tail -n 1)" + [ -n "${image}" ] || die "cannot determine ${label} image name from docker load output" + printf '%s\n' "${image}" +} + +find_single_tar() { + local label="$1" + local include_pattern="$2" + local exclude_pattern="${3:-}" + local matches=() + local file + + while IFS= read -r -d '' file; do + matches+=("${file}") + done < <( + if [ -n "${exclude_pattern}" ]; then + find "${IMAGE_DIR}" -maxdepth 1 -type f -name "${include_pattern}" ! -name "${exclude_pattern}" -print0 | sort -z + else + find "${IMAGE_DIR}" -maxdepth 1 -type f -name "${include_pattern}" -print0 | sort -z + fi + ) + + case "${#matches[@]}" in + 0) + die "no ${label} image tarball found under ${IMAGE_DIR} matching ${include_pattern}" + ;; + 1) + printf '%s\n' "${matches[0]}" + ;; + *) + printf '[00_install] ERROR: multiple %s image tarballs found:\n' "${label}" >&2 + printf ' %s\n' "${matches[@]}" >&2 + die "please specify --${label}-tar or RPKI_RTR_${label^^}_IMAGE_TAR" + ;; + esac +} + +stage "Checking Docker" +command -v docker >/dev/null 2>&1 || die "docker command not found" +[ -d "${IMAGE_DIR}" ] || die "image directory not found: ${IMAGE_DIR}" +[ -f "${SERVER_ENV_FILE}" ] || die "server env file not found: ${SERVER_ENV_FILE}" + +if [ -n "${SERVER_TAR}" ]; then + SERVER_TAR="$(resolve_tar "${SERVER_TAR}")" || die "server image tarball not found: ${SERVER_TAR}" +else + SERVER_TAR="$(find_single_tar server 'rpki-rtr-*.tar' 'rpki-rtr-debug-client-*.tar')" +fi + +if [ -n "${CLIENT_TAR}" ]; then + CLIENT_TAR="$(resolve_tar "${CLIENT_TAR}")" || die "client image tarball not found: ${CLIENT_TAR}" +else + CLIENT_TAR="$(find_single_tar client 'rpki-rtr-debug-client-*.tar')" +fi + +if [ -n "${CONSOLE_TAR}" ]; then + CONSOLE_TAR="$(resolve_tar "${CONSOLE_TAR}")" || die "console image tarball not found: ${CONSOLE_TAR}" +else + CONSOLE_TAR="$(find_single_tar console 'rpki-console-ui-*.tar')" +fi + +stage "Loading Docker Images" +SERVER_IMAGE="$(load_image server "${SERVER_TAR}")" +CLIENT_IMAGE="$(load_image client "${CLIENT_TAR}")" +CONSOLE_IMAGE="$(load_image console "${CONSOLE_TAR}")" + +stage "Updating Deploy Env" +set_env_var "${SERVER_ENV_FILE}" RPKI_RTR_SERVER_IMAGE "${SERVER_IMAGE}" +set_env_var "${CONSOLE_ENV_FILE}" RPKI_CONSOLE_UI_IMAGE "${CONSOLE_IMAGE}" + +stage "Running Pre-Check" +RPKI_RTR_SERVER_IMAGE="${SERVER_IMAGE}" \ +RPKI_RTR_CLIENT_IMAGE="${CLIENT_IMAGE}" \ +bash "${SCRIPT_DIR}/00_1_pre_check.sh" || die "pre-check failed" + +stage "Install Finished" diff --git a/scripts/00_1_pre_check.sh b/scripts/00_1_pre_check.sh new file mode 100644 index 0000000..a3a6f9c --- /dev/null +++ b/scripts/00_1_pre_check.sh @@ -0,0 +1,155 @@ +#!/usr/bin/env bash +set -euo pipefail + +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +ROOT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)" + +PRECHECK_WORK_DIR="${PRECHECK_WORK_DIR:-${ROOT_DIR}/.precheck}" +PRECHECK_ENV_FILE="${PRECHECK_ENV_FILE:-${PRECHECK_WORK_DIR}/precheck.env}" +PRECHECK_WAIT_SECS="${PRECHECK_WAIT_SECS:-60}" +KEEP_PRECHECK="${KEEP_PRECHECK:-0}" + +log() { + printf '[00_1_pre_check] %s\n' "$*" +} + +stage() { + printf '\n====== %s ======\n' "$*" +} + +die() { + printf '[00_1_pre_check] ERROR: %s\n' "$*" >&2 + exit 1 +} + +command -v docker >/dev/null 2>&1 || die "docker command not found" +if docker compose version >/dev/null 2>&1; then + COMPOSE_BIN=(docker compose) +elif command -v docker-compose >/dev/null 2>&1 && docker-compose version >/dev/null 2>&1; then + COMPOSE_BIN=(docker-compose) +else + die "docker compose is not available" +fi + +stage "Preparing Pre-Check Data" +bash "${SCRIPT_DIR}/00_2_pre_check_prepare.sh" || die "prepare step failed" + +set -a +# shellcheck disable=SC1090 +. "${PRECHECK_ENV_FILE}" +set +a + +ADMIN_PORT="${RPKI_RTR_ADMIN_ADDR##*:}" +ADMIN_TOKEN="${RPKI_RTR_ADMIN_TOKEN}" + +server_compose() { + "${COMPOSE_BIN[@]}" --env-file "${PRECHECK_ENV_FILE}" -p "${PRECHECK_PROJECT}" -f "${PRECHECK_SERVER_COMPOSE_FILE}" "$@" +} + +client_compose() { + "${COMPOSE_BIN[@]}" --env-file "${PRECHECK_ENV_FILE}" -p "${PRECHECK_PROJECT}" -f "${PRECHECK_CLIENT_COMPOSE_FILE}" "$@" +} + +cleanup() { + KEEP_PRECHECK="${KEEP_PRECHECK}" PRECHECK_WORK_DIR="${PRECHECK_WORK_DIR}" PRECHECK_ENV_FILE="${PRECHECK_ENV_FILE}" \ + bash "${SCRIPT_DIR}/00_3_pre_check_cleanup.sh" +} +trap cleanup EXIT + +http_get() { + local host="$1" + local port="$2" + local path="$3" + local token="$4" + + exec 3<>"/dev/tcp/${host}/${port}" || return 1 + printf 'GET %s HTTP/1.1\r\nHost: %s:%s\r\nAuthorization: Bearer %s\r\nConnection: close\r\n\r\n' \ + "${path}" "${host}" "${port}" "${token}" >&3 + cat <&3 + exec 3>&- +} + +wait_for_admin_health() { + local deadline=$((SECONDS + PRECHECK_WAIT_SECS)) + local response + + log "waiting for server health" + while [ "${SECONDS}" -lt "${deadline}" ]; do + response="$(http_get 127.0.0.1 "${ADMIN_PORT}" /admin/rtr/health "${ADMIN_TOKEN}" 2>/dev/null || true)" + if printf '%s' "${response}" | grep -q '"status"[[:space:]]*:[[:space:]]*"ok"'; then + log "admin health check passed" + return 0 + fi + + if [ "$(server_compose ps -q rpki-rtr | wc -l | tr -d ' ')" = "0" ]; then + server_compose logs rpki-rtr || true + die "server container is not running" + fi + sleep 1 + done + + server_compose logs rpki-rtr || true + die "admin health check did not pass within ${PRECHECK_WAIT_SECS}s" +} + +wait_for_client_eod() { + local deadline=$((SECONDS + PRECHECK_WAIT_SECS)) + local log_file + + log "waiting for client response" + while [ "${SECONDS}" -lt "${deadline}" ]; do + for log_file in "${PRECHECK_WORK_DIR}"/logs/client/*.stdout.log; do + [ -f "${log_file}" ] || continue + if grep -q 'EndOfData:' "${log_file}" && grep -q 'summary[[:space:]]*:' "${log_file}"; then + log "client received EndOfData and payload summary" + return 0 + fi + if grep -qi 'Error Report' "${log_file}"; then + cat "${log_file}" >&2 + die "client received RTR Error Report" + fi + done + sleep 1 + done + + find "${PRECHECK_WORK_DIR}/logs/client" -type f -maxdepth 1 -print -exec cat {} \; >&2 || true + die "client did not receive EndOfData and summary within ${PRECHECK_WAIT_SECS}s" +} + +assert_no_error_logs() { + local bad + log "checking logs" + bad="$(find "${PRECHECK_WORK_DIR}/logs" -type f -name '*.log' -print0 \ + | xargs -0 grep -Ein 'panic|failed|RTR admin config server exited|Error Report' 2>/dev/null || true)" + if [ -n "${bad}" ]; then + printf '%s\n' "${bad}" >&2 + die "error pattern found in pre-check logs" + fi +} + +assert_report_written() { + local deadline=$((SECONDS + PRECHECK_WAIT_SECS)) + + log "waiting for source report" + while [ "${SECONDS}" -lt "${deadline}" ]; do + if find "${PRECHECK_WORK_DIR}/report" -type f -name 'rtr-source-*.json' | grep -q .; then + log "source report written" + return 0 + fi + sleep 1 + done + + die "server did not write rtr-source report within ${PRECHECK_WAIT_SECS}s" +} + +stage "Starting RTR Server" +server_compose up -d --no-build rpki-rtr +wait_for_admin_health +assert_report_written + +stage "Starting Debug Client" +client_compose up -d --no-build rtr-debug-client +wait_for_client_eod + +assert_no_error_logs +stage "Pre-Check Passed" diff --git a/scripts/00_2_generate_ccr.sh b/scripts/00_2_generate_ccr.sh new file mode 100644 index 0000000..d115d9c --- /dev/null +++ b/scripts/00_2_generate_ccr.sh @@ -0,0 +1,54 @@ +#!/usr/bin/env bash +set -euo pipefail + +OUT_PATH="${1:-}" + +usage() { + cat <<'EOF' +Usage: scripts/00_2_generate_ccr.sh OUT.ccr + +Generate a small deterministic CCR snapshot for pre-check. +This script writes a fixed base64-encoded CCR fixture and does not require Python. +The generated snapshot contains: + - VRP: 10.0.0.0/24 maxLen 24 AS65001 + - VRP: 10.0.1.0/24 maxLen 24 AS65003 + - VRP: 2001:db8:1::/48 maxLen 48 AS65002 + - ASPA: customer AS65010 providers AS65011, AS65012, AS65013 + - ASPA: customer AS65020 provider AS65021 +EOF +} + +die() { + printf '[00_2_generate_ccr] ERROR: %s\n' "$*" >&2 + exit 1 +} + +if [ "${OUT_PATH}" = "-h" ] || [ "${OUT_PATH}" = "--help" ]; then + usage + exit 0 +fi + +[ -n "${OUT_PATH}" ] || die "missing OUT.ccr" +mkdir -p "$(dirname "${OUT_PATH}")" + +decode_base64() { + if command -v base64 >/dev/null 2>&1; then + base64 -d + return + fi + + if command -v openssl >/dev/null 2>&1; then + openssl base64 -d + return + fi + + die "base64 or openssl command is required to write CCR fixture" +} + +cat <<'EOF' | decode_base64 >"${OUT_PATH}" +MIIBAwYLKoZIhvcNAQkQATaggfMwgfACAQAwDQYJYIZIAWUDBAIBBQAYDzIwMjYwNDAzMDAwMjAx +WqJ9MHswVzAaAgMA/ekwEzARBAIAATALMAkDBAAKAAACARgwGgIDAP3rMBMwEQQCAAEwCzAJAwQA +CgABAgEYMB0CAwD96jAWMBQEAgACMA4wDAMHACABDbgAAQIBMAQgsUgCHfy5AJcFp5RymOD0HuGO +wfhoWpll90ugYECGQPSjTDBKMCYwFgIDAP3yMA8CAwD98wIDAP30AgMA/fUwDAIDAP38MAUCAwD9 +/QQgRPxVPOOUsUuuV4tZ8BG5PHNtKiaEr23Ird+yNxlWJ+w= +EOF diff --git a/scripts/00_2_pre_check_prepare.sh b/scripts/00_2_pre_check_prepare.sh new file mode 100644 index 0000000..dd54e0f --- /dev/null +++ b/scripts/00_2_pre_check_prepare.sh @@ -0,0 +1,96 @@ +#!/usr/bin/env bash +set -euo pipefail + +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +ROOT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)" + +PRECHECK_WORK_DIR="${PRECHECK_WORK_DIR:-${ROOT_DIR}/.precheck}" +PRECHECK_PROJECT="${PRECHECK_PROJECT:-rpki-precheck}" +PRECHECK_ADMIN_TOKEN="${PRECHECK_ADMIN_TOKEN:-rpki-precheck-token}" +PRECHECK_PROTOCOL_VERSION="${PRECHECK_PROTOCOL_VERSION:-2}" +PRECHECK_SERVER_IMAGE="${PRECHECK_SERVER_IMAGE:-${RPKI_RTR_SERVER_IMAGE:-rpki-rtr-arm64:v1.2}}" +PRECHECK_CLIENT_IMAGE="${PRECHECK_CLIENT_IMAGE:-${RPKI_RTR_CLIENT_IMAGE:-rpki-rtr-debug-client-arm64:v1.2}}" + +log() { + printf '[00_1_pre_check_prepare] %s\n' "$*" +} + +die() { + printf '[00_1_pre_check_prepare] ERROR: %s\n' "$*" >&2 + exit 1 +} + +abs_dir() { + local path="$1" + mkdir -p "${path}" + cd "${path}" && pwd -P +} + +[ -f "${SCRIPT_DIR}/00_2_generate_ccr.sh" ] || die "missing ${SCRIPT_DIR}/00_2_generate_ccr.sh" + +rm -rf "${PRECHECK_WORK_DIR}" +mkdir -p \ + "${PRECHECK_WORK_DIR}/ccr" \ + "${PRECHECK_WORK_DIR}/slurm" \ + "${PRECHECK_WORK_DIR}/db" \ + "${PRECHECK_WORK_DIR}/logs/server" \ + "${PRECHECK_WORK_DIR}/logs/client" \ + "${PRECHECK_WORK_DIR}/report" + +bash "${SCRIPT_DIR}/00_2_generate_ccr.sh" \ + "${PRECHECK_WORK_DIR}/ccr/20260403T000201Z-precheck.ccr" + +cat >"${PRECHECK_WORK_DIR}/slurm/precheck.slurm" <<'EOF' +{ + "slurmVersion": 2, + "validationOutputFilters": { + "prefixFilters": [], + "bgpsecFilters": [], + "aspaFilters": [] + }, + "locallyAddedAssertions": { + "prefixAssertions": [ + { + "prefix": "203.0.113.0/24", + "maxPrefixLength": 24, + "asn": 64496, + "comment": "pre-check local assertion" + } + ], + "bgpsecAssertions": [], + "aspaAssertions": [] + } +} +EOF + +PRECHECK_WORK_DIR_ABS="$(abs_dir "${PRECHECK_WORK_DIR}")" +cat >"${PRECHECK_WORK_DIR}/precheck.env" </dev/null 2>&1; then + COMPOSE_BIN=(docker compose) + elif command -v docker-compose >/dev/null 2>&1 && docker-compose version >/dev/null 2>&1; then + COMPOSE_BIN=(docker-compose) + else + return 0 + fi + fi + + "${COMPOSE_BIN[@]}" --env-file "${ENV_FILE}" -p "${PRECHECK_PROJECT}" -f "${compose_file}" "$@" +} + +if command -v docker >/dev/null 2>&1; then + log "stopping pre-check client compose stack" + [ -f "${PRECHECK_CLIENT_COMPOSE_FILE}" ] && compose_run "${PRECHECK_CLIENT_COMPOSE_FILE}" down --remove-orphans >/dev/null 2>&1 || true + log "stopping pre-check server compose stack" + [ -f "${PRECHECK_SERVER_COMPOSE_FILE}" ] && compose_run "${PRECHECK_SERVER_COMPOSE_FILE}" down --remove-orphans >/dev/null 2>&1 || true +fi + +if [ "${KEEP_PRECHECK}" = "1" ]; then + log "KEEP_PRECHECK=1, preserving ${PRECHECK_WORK_DIR}" +else + rm -rf "${PRECHECK_WORK_DIR}" + log "removed ${PRECHECK_WORK_DIR}" +fi diff --git a/scripts/01_start.sh b/scripts/01_start.sh new file mode 100644 index 0000000..308db65 --- /dev/null +++ b/scripts/01_start.sh @@ -0,0 +1,159 @@ +#!/usr/bin/env bash +set -euo pipefail + +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +ROOT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)" + +COMMON_ENV_FILE="${ROOT_DIR}/environment" +SERVER_ENV_FILE="${ROOT_DIR}/deploy/server/.env" +CONSOLE_ENV_FILE="${ROOT_DIR}/deploy/console/.env" +CONSOLE_COMPOSE_FILE="${ROOT_DIR}/deploy/console/docker-compose.yml" +MODE="${RPKI_RTR_SERVER_MODE:-tcp}" +COMPOSE_PROJECT="${RPKI_RTR_COMPOSE_PROJECT:-rpki-rtr}" +CONSOLE_COMPOSE_PROJECT="${RPKI_CONSOLE_COMPOSE_PROJECT:-rpki-console}" + +usage() { + cat <<'EOF' +Usage: scripts/01_start.sh [options] + +Read root ./environment, update deploy/server/.env, then start the RTR server and console. + +Options: + --env FILE Common env file. Default: ./environment + --mode MODE Server mode: tcp|tls|ssh|base. Default: tcp + -h, --help Show this help. +EOF +} + +log() { + printf '[01_start] %s\n' "$*" >&2 +} + +stage() { + printf '\n====== %s ======\n' "$*" >&2 +} + +die() { + printf '[01_start] ERROR: %s\n' "$*" >&2 + exit 1 +} + +set_env_var() { + local env_file="$1" + local key="$2" + local value="$3" + local tmp_file + + tmp_file="${env_file}.tmp.$$" + awk -v key="${key}" -v value="${value}" ' + BEGIN { done = 0 } + $0 ~ "^[[:space:]]*#?[[:space:]]*" key "=" { + if (!done) { + print key "=" value + done = 1 + } + next + } + { print } + END { + if (!done) { + print key "=" value + } + } + ' "${env_file}" >"${tmp_file}" + mv "${tmp_file}" "${env_file}" +} + +compose_file_for_mode() { + case "$1" in + tcp) printf '%s\n' "${ROOT_DIR}/deploy/server/docker-compose.tcp.yml" ;; + tls) printf '%s\n' "${ROOT_DIR}/deploy/server/docker-compose.tls.yml" ;; + ssh) printf '%s\n' "${ROOT_DIR}/deploy/server/docker-compose.ssh.yml" ;; + base) printf '%s\n' "${ROOT_DIR}/deploy/server/docker-compose.yml" ;; + *) die "unsupported mode '$1', expected tcp|tls|ssh|base" ;; + esac +} + +update_env_from_common() { + local target_env_file="$1" + local updated_count=0 + local line key value + + while IFS= read -r line || [ -n "${line}" ]; do + case "${line}" in + ''|\#*) continue ;; + *=*) + key="${line%%=*}" + value="${line#*=}" + set_env_var "${target_env_file}" "${key}" "${value}" + updated_count=$((updated_count + 1)) + ;; + esac + done <"${COMMON_ENV_FILE}" + + printf '%s\n' "${updated_count}" +} + +while [ "$#" -gt 0 ]; do + case "$1" in + --env) + [ "$#" -ge 2 ] || die "--env requires a value" + COMMON_ENV_FILE="$2" + shift 2 + ;; + --mode) + [ "$#" -ge 2 ] || die "--mode requires a value" + MODE="$2" + shift 2 + ;; + -h|--help) + usage + exit 0 + ;; + *) + die "unknown option: $1" + ;; + esac +done + +SERVER_COMPOSE_FILE="$(compose_file_for_mode "${MODE}")" + +stage "Checking Docker" +command -v docker >/dev/null 2>&1 || die "docker command not found" +if docker compose version >/dev/null 2>&1; then + COMPOSE_BIN=(docker compose) +elif command -v docker-compose >/dev/null 2>&1 && docker-compose version >/dev/null 2>&1; then + COMPOSE_BIN=(docker-compose) +else + die "docker compose is not available" +fi + +[ -f "${SERVER_ENV_FILE}" ] || die "server env file not found: ${SERVER_ENV_FILE}" +[ -f "${SERVER_COMPOSE_FILE}" ] || die "server compose file not found: ${SERVER_COMPOSE_FILE}" +[ -f "${CONSOLE_ENV_FILE}" ] || die "console env file not found: ${CONSOLE_ENV_FILE}" +[ -f "${CONSOLE_COMPOSE_FILE}" ] || die "console compose file not found: ${CONSOLE_COMPOSE_FILE}" + +if [ -f "${COMMON_ENV_FILE}" ]; then + stage "Reading Environment" + server_updated_count="$(update_env_from_common "${SERVER_ENV_FILE}")" + log "updated ${server_updated_count} server env variable(s)" +else + stage "Reading Environment" + log "environment file not found, skip env update" +fi + +stage "Starting RTR Server" +log "starting docker compose service: rpki-rtr" +"${COMPOSE_BIN[@]}" --env-file "${SERVER_ENV_FILE}" -p "${COMPOSE_PROJECT}" -f "${SERVER_COMPOSE_FILE}" up -d --no-build rpki-rtr + +log "checking server compose status" +"${COMPOSE_BIN[@]}" --env-file "${SERVER_ENV_FILE}" -p "${COMPOSE_PROJECT}" -f "${SERVER_COMPOSE_FILE}" ps rpki-rtr + +stage "Starting Console" +log "starting docker compose service: rpki-console-ui" +"${COMPOSE_BIN[@]}" --env-file "${CONSOLE_ENV_FILE}" -p "${CONSOLE_COMPOSE_PROJECT}" -f "${CONSOLE_COMPOSE_FILE}" up -d --no-build rpki-console-ui + +log "checking console compose status" +"${COMPOSE_BIN[@]}" --env-file "${CONSOLE_ENV_FILE}" -p "${CONSOLE_COMPOSE_PROJECT}" -f "${CONSOLE_COMPOSE_FILE}" ps rpki-console-ui + +stage "Start Finished" diff --git a/scripts/02_self_check.sh b/scripts/02_self_check.sh new file mode 100644 index 0000000..94b529f --- /dev/null +++ b/scripts/02_self_check.sh @@ -0,0 +1,184 @@ +#!/usr/bin/env bash +set -euo pipefail + +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +ROOT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)" + +SERVER_ENV_FILE="${ROOT_DIR}/deploy/server/.env" +CONSOLE_ENV_FILE="${ROOT_DIR}/deploy/console/.env" +SERVER_COMPOSE_FILE="${ROOT_DIR}/deploy/server/docker-compose.tcp.yml" +CONSOLE_COMPOSE_FILE="${ROOT_DIR}/deploy/console/docker-compose.yml" +SERVER_PROJECT="${RPKI_RTR_COMPOSE_PROJECT:-rpki-rtr}" +CONSOLE_PROJECT="${RPKI_CONSOLE_COMPOSE_PROJECT:-rpki-console}" +WAIT_SECS="${RPKI_SELF_CHECK_WAIT_SECS:-60}" + +usage() { + cat <<'EOF' +Usage: scripts/02_self_check.sh [options] + +Check whether the RTR server and console started by scripts/01_start.sh are healthy. + +Options: + --wait SECS Wait timeout for each check. Default: 60 + -h, --help Show this help. +EOF +} + +log() { + printf '[02_self_check] %s\n' "$*" >&2 +} + +stage() { + printf '\n====== %s ======\n' "$*" >&2 +} + +die() { + printf '[02_self_check] ERROR: %s\n' "$*" >&2 + exit 1 +} + +while [ "$#" -gt 0 ]; do + case "$1" in + --wait) + [ "$#" -ge 2 ] || die "--wait requires a value" + WAIT_SECS="$2" + shift 2 + ;; + -h|--help) + usage + exit 0 + ;; + *) + die "unknown option: $1" + ;; + esac +done + +command -v docker >/dev/null 2>&1 || die "docker command not found" +if docker compose version >/dev/null 2>&1; then + COMPOSE_BIN=(docker compose) +elif command -v docker-compose >/dev/null 2>&1 && docker-compose version >/dev/null 2>&1; then + COMPOSE_BIN=(docker-compose) +else + die "docker compose is not available" +fi + +[ -f "${SERVER_ENV_FILE}" ] || die "server env file not found: ${SERVER_ENV_FILE}" +[ -f "${SERVER_COMPOSE_FILE}" ] || die "server compose file not found: ${SERVER_COMPOSE_FILE}" +[ -f "${CONSOLE_ENV_FILE}" ] || die "console env file not found: ${CONSOLE_ENV_FILE}" +[ -f "${CONSOLE_COMPOSE_FILE}" ] || die "console compose file not found: ${CONSOLE_COMPOSE_FILE}" + +set -a +# shellcheck disable=SC1090 +. "${SERVER_ENV_FILE}" +# shellcheck disable=SC1090 +. "${CONSOLE_ENV_FILE}" +set +a + +RTR_PORT="${RPKI_RTR_TCP_HOST_PORT:-323}" +ADMIN_PORT="${RPKI_RTR_ADMIN_ADDR##*:}" +ADMIN_PORT="${ADMIN_PORT:-8323}" +ADMIN_TOKEN="${RPKI_RTR_ADMIN_TOKEN:-}" +CONSOLE_PORT="${RPKI_CONSOLE_UI_PORT:-5173}" + +server_compose() { + "${COMPOSE_BIN[@]}" --env-file "${SERVER_ENV_FILE}" -p "${SERVER_PROJECT}" -f "${SERVER_COMPOSE_FILE}" "$@" +} + +console_compose() { + "${COMPOSE_BIN[@]}" --env-file "${CONSOLE_ENV_FILE}" -p "${CONSOLE_PROJECT}" -f "${CONSOLE_COMPOSE_FILE}" "$@" +} + +container_running() { + local compose_kind="$1" + local service="$2" + local cid state + + if [ "${compose_kind}" = "server" ]; then + cid="$(server_compose ps -q "${service}" 2>/dev/null || true)" + else + cid="$(console_compose ps -q "${service}" 2>/dev/null || true)" + fi + + [ -n "${cid}" ] || return 1 + state="$(docker inspect -f '{{.State.Running}}' "${cid}" 2>/dev/null || true)" + [ "${state}" = "true" ] +} + +tcp_open() { + local host="$1" + local port="$2" + + if command -v nc >/dev/null 2>&1; then + nc -z "${host}" "${port}" >/dev/null 2>&1 + return + fi + + (exec 3<>"/dev/tcp/${host}/${port}") >/dev/null 2>&1 +} + +http_get() { + local url="$1" + local token="${2:-}" + + if command -v curl >/dev/null 2>&1; then + if [ -n "${token}" ]; then + curl -fsS -H "Authorization: Bearer ${token}" "${url}" + else + curl -fsS "${url}" + fi + return + fi + + die "curl command is required for HTTP health checks" +} + +wait_until() { + local label="$1" + shift + local deadline=$((SECONDS + WAIT_SECS)) + + while [ "${SECONDS}" -lt "${deadline}" ]; do + if "$@"; then + log "${label}: ok" + return 0 + fi + sleep 1 + done + + die "${label}: failed after ${WAIT_SECS}s" +} + +show_command() { + printf '[02_self_check] check command: %s\n' "$*" >&2 +} + +check_admin_health() { + local body + body="$(http_get "http://127.0.0.1:${ADMIN_PORT}/admin/rtr/health" "${ADMIN_TOKEN}" 2>/dev/null || true)" + printf '%s' "${body}" | grep -q '"status"[[:space:]]*:[[:space:]]*"ok"' +} + +check_console_http() { + http_get "http://127.0.0.1:${CONSOLE_PORT}/" >/dev/null 2>&1 +} + +stage "Checking Containers" +show_command "${COMPOSE_BIN[*]} --env-file ${SERVER_ENV_FILE} -p ${SERVER_PROJECT} -f ${SERVER_COMPOSE_FILE} ps -q rpki-rtr && docker inspect" +wait_until "server container" container_running server rpki-rtr +show_command "${COMPOSE_BIN[*]} --env-file ${CONSOLE_ENV_FILE} -p ${CONSOLE_PROJECT} -f ${CONSOLE_COMPOSE_FILE} ps -q rpki-console-ui && docker inspect" +wait_until "console container" container_running console rpki-console-ui + +stage "Checking Server" +show_command "tcp connect 127.0.0.1:${RTR_PORT}" +wait_until "RTR port ${RTR_PORT}" tcp_open 127.0.0.1 "${RTR_PORT}" +show_command "curl -fsS -H 'Authorization: Bearer ' http://127.0.0.1:${ADMIN_PORT}/admin/rtr/health" +wait_until "Admin health" check_admin_health + +stage "Checking Console" +show_command "tcp connect 127.0.0.1:${CONSOLE_PORT}" +wait_until "Console port ${CONSOLE_PORT}" tcp_open 127.0.0.1 "${CONSOLE_PORT}" +show_command "curl -fsS http://127.0.0.1:${CONSOLE_PORT}/" +wait_until "Console HTTP" check_console_http + +stage "Self-Check Passed" diff --git a/scripts/03_shutdown.sh b/scripts/03_shutdown.sh new file mode 100644 index 0000000..cac1cf3 --- /dev/null +++ b/scripts/03_shutdown.sh @@ -0,0 +1,92 @@ +#!/usr/bin/env bash +set -euo pipefail + +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +ROOT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)" + +SERVER_ENV_FILE="${ROOT_DIR}/deploy/server/.env" +CONSOLE_ENV_FILE="${ROOT_DIR}/deploy/console/.env" +MODE="${RPKI_RTR_SERVER_MODE:-tcp}" +SERVER_PROJECT="${RPKI_RTR_COMPOSE_PROJECT:-rpki-rtr}" +CONSOLE_PROJECT="${RPKI_CONSOLE_COMPOSE_PROJECT:-rpki-console}" + +usage() { + cat <<'EOF' +Usage: scripts/03_shutdown.sh [options] + +Stop services started by scripts/01_start.sh. + +Options: + --mode MODE Server mode: tcp|tls|ssh|base. Default: tcp + -h, --help Show this help. +EOF +} + +log() { + printf '[03_shutdown] %s\n' "$*" >&2 +} + +stage() { + printf '\n====== %s ======\n' "$*" >&2 +} + +die() { + printf '[03_shutdown] ERROR: %s\n' "$*" >&2 + exit 1 +} + +compose_file_for_mode() { + case "$1" in + tcp) printf '%s\n' "${ROOT_DIR}/deploy/server/docker-compose.tcp.yml" ;; + tls) printf '%s\n' "${ROOT_DIR}/deploy/server/docker-compose.tls.yml" ;; + ssh) printf '%s\n' "${ROOT_DIR}/deploy/server/docker-compose.ssh.yml" ;; + base) printf '%s\n' "${ROOT_DIR}/deploy/server/docker-compose.yml" ;; + *) die "unsupported mode '$1', expected tcp|tls|ssh|base" ;; + esac +} + +while [ "$#" -gt 0 ]; do + case "$1" in + --mode) + [ "$#" -ge 2 ] || die "--mode requires a value" + MODE="$2" + shift 2 + ;; + -h|--help) + usage + exit 0 + ;; + *) + die "unknown option: $1" + ;; + esac +done + +SERVER_COMPOSE_FILE="$(compose_file_for_mode "${MODE}")" +CONSOLE_COMPOSE_FILE="${ROOT_DIR}/deploy/console/docker-compose.yml" + +stage "Checking Docker" +command -v docker >/dev/null 2>&1 || die "docker command not found" +if docker compose version >/dev/null 2>&1; then + COMPOSE_BIN=(docker compose) +elif command -v docker-compose >/dev/null 2>&1 && docker-compose version >/dev/null 2>&1; then + COMPOSE_BIN=(docker-compose) +else + die "docker compose is not available" +fi + +stage "Stopping Console" +if [ -f "${CONSOLE_ENV_FILE}" ] && [ -f "${CONSOLE_COMPOSE_FILE}" ]; then + "${COMPOSE_BIN[@]}" --env-file "${CONSOLE_ENV_FILE}" -p "${CONSOLE_PROJECT}" -f "${CONSOLE_COMPOSE_FILE}" down --remove-orphans +else + log "console compose/env not found, skip" +fi + +stage "Stopping RTR Server" +if [ -f "${SERVER_ENV_FILE}" ] && [ -f "${SERVER_COMPOSE_FILE}" ]; then + "${COMPOSE_BIN[@]}" --env-file "${SERVER_ENV_FILE}" -p "${SERVER_PROJECT}" -f "${SERVER_COMPOSE_FILE}" down --remove-orphans +else + log "server compose/env not found, skip" +fi + +stage "Shutdown Finished" diff --git a/scripts/10_generate_certs.sh b/scripts/10_generate_certs.sh new file mode 100644 index 0000000..e66e113 --- /dev/null +++ b/scripts/10_generate_certs.sh @@ -0,0 +1,303 @@ +#!/usr/bin/env bash +set -euo pipefail + +ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" +OUT_DIR="${ROOT_DIR}/certs" +TLS_DIR="${OUT_DIR}/tls" +SSH_DIR="${OUT_DIR}/ssh" +SERVER_DNS="localhost" +FORCE=0 +DO_TLS=1 +DO_SSH=1 + +usage() { + cat <<'USAGE' +Generate local development TLS certificates and SSH keys for RTR Docker deploys. + +Usage: + scripts/10_generate-certs.sh [options] + +Options: + --out-dir DIR Output directory, default: ./certs + --server-dns NAME TLS server dNSName SAN, default: localhost + --tls-only Generate only TLS files + --ssh-only Generate only SSH files + --force Overwrite existing files + -h, --help Show this help + +Generated TLS files: + certs/tls/client-ca.crt + certs/tls/client-ca.key + certs/tls/server-dns.crt + certs/tls/server-dns.key + certs/tls/client-good.crt + certs/tls/client-good.key + +Generated SSH files: + certs/ssh/ssh_host_rsa_key + certs/ssh/ssh_host_rsa_key.pub + certs/ssh/rtr-client.key + certs/ssh/rtr-client.key.pub + certs/ssh/rtr-authorized_keys +USAGE +} + +die() { + echo "error: $*" >&2 + exit 1 +} + +info() { + echo "[generate-certs] $*" +} + +need_cmd() { + command -v "$1" >/dev/null 2>&1 || die "required command not found: $1" +} + +run_quiet() { + local log_file + log_file="$(mktemp)" + if "$@" >"${log_file}" 2>&1; then + rm -f "${log_file}" + return 0 + fi + + cat "${log_file}" >&2 + rm -f "${log_file}" + return 1 +} + +ensure_abs_out_dir() { + case "${OUT_DIR}" in + /*) ;; + [A-Za-z]:*) ;; + *) OUT_DIR="${ROOT_DIR}/${OUT_DIR}" ;; + esac + TLS_DIR="${OUT_DIR}/tls" + SSH_DIR="${OUT_DIR}/ssh" +} + +check_overwrite() { + local path="$1" + if [[ -e "${path}" && "${FORCE}" != "1" ]]; then + die "${path} already exists; rerun with --force to overwrite" + fi +} + +write_tls_config_files() { + local tmp_dir="$1" + + cat >"${tmp_dir}/ca.cnf" <<'EOF' +[ req ] +distinguished_name = req_distinguished_name +prompt = no + +[ req_distinguished_name ] +CN = rpki-rtr-client-ca +EOF + + cat >"${tmp_dir}/server.cnf" <"${tmp_dir}/client.cnf" <<'EOF' +[ req ] +distinguished_name = req_distinguished_name +prompt = no + +[ req_distinguished_name ] +CN = rpki-rtr-client +EOF + + cat >"${tmp_dir}/server.ext" <"${tmp_dir}/client.ext" <<'EOF' +basicConstraints=CA:FALSE +keyUsage=digitalSignature,keyEncipherment +extendedKeyUsage=clientAuth +EOF +} + +generate_tls() { + need_cmd openssl + mkdir -p "${TLS_DIR}" + + info "generating TLS certificates in ${TLS_DIR}" + info "TLS server dNSName SAN: ${SERVER_DNS}" + + local files=( + "${TLS_DIR}/client-ca.crt" + "${TLS_DIR}/client-ca.key" + "${TLS_DIR}/server-dns.crt" + "${TLS_DIR}/server-dns.key" + "${TLS_DIR}/client-good.crt" + "${TLS_DIR}/client-good.key" + ) + for file in "${files[@]}"; do + check_overwrite "${file}" + done + + local tmp_dir + tmp_dir="$(mktemp -d)" + write_tls_config_files "${tmp_dir}" + + run_quiet openssl genrsa -out "${TLS_DIR}/client-ca.key" 2048 + info "created TLS CA key: ${TLS_DIR}/client-ca.key" + run_quiet openssl req -x509 -new -nodes \ + -config "${tmp_dir}/ca.cnf" \ + -key "${TLS_DIR}/client-ca.key" \ + -sha256 -days 3650 \ + -out "${TLS_DIR}/client-ca.crt" + info "created TLS CA cert: ${TLS_DIR}/client-ca.crt" + + run_quiet openssl genrsa -out "${TLS_DIR}/server-dns.key" 2048 + info "created TLS server key: ${TLS_DIR}/server-dns.key" + run_quiet openssl req -new \ + -config "${tmp_dir}/server.cnf" \ + -key "${TLS_DIR}/server-dns.key" \ + -out "${tmp_dir}/server-dns.csr" + run_quiet openssl x509 -req \ + -in "${tmp_dir}/server-dns.csr" \ + -CA "${TLS_DIR}/client-ca.crt" \ + -CAkey "${TLS_DIR}/client-ca.key" \ + -CAcreateserial \ + -out "${TLS_DIR}/server-dns.crt" \ + -days 3650 -sha256 \ + -extfile "${tmp_dir}/server.ext" + info "created TLS server cert: ${TLS_DIR}/server-dns.crt" + + run_quiet openssl genrsa -out "${TLS_DIR}/client-good.key" 2048 + info "created TLS client key: ${TLS_DIR}/client-good.key" + run_quiet openssl req -new \ + -config "${tmp_dir}/client.cnf" \ + -key "${TLS_DIR}/client-good.key" \ + -out "${tmp_dir}/client-good.csr" + run_quiet openssl x509 -req \ + -in "${tmp_dir}/client-good.csr" \ + -CA "${TLS_DIR}/client-ca.crt" \ + -CAkey "${TLS_DIR}/client-ca.key" \ + -CAcreateserial \ + -out "${TLS_DIR}/client-good.crt" \ + -days 3650 -sha256 \ + -extfile "${tmp_dir}/client.ext" + info "created TLS client cert: ${TLS_DIR}/client-good.crt" + + rm -f "${TLS_DIR}/client-ca.srl" + rm -rf "${tmp_dir}" + chmod 600 "${TLS_DIR}"/*.key + chmod 644 "${TLS_DIR}"/*.crt +} + +generate_ssh_key() { + local path="$1" + local comment="$2" + check_overwrite "${path}" + check_overwrite "${path}.pub" + rm -f "${path}" "${path}.pub" + run_quiet ssh-keygen -q -t rsa -b 3072 -m PEM -N "" -C "${comment}" -f "${path}" +} + +generate_ssh() { + need_cmd ssh-keygen + mkdir -p "${SSH_DIR}" + + info "generating SSH keys in ${SSH_DIR}" + generate_ssh_key "${SSH_DIR}/ssh_host_rsa_key" "rpki-rtr-host" + info "created SSH host key: ${SSH_DIR}/ssh_host_rsa_key" + generate_ssh_key "${SSH_DIR}/rtr-client.key" "rpki-rtr-debug-client" + info "created SSH client key: ${SSH_DIR}/rtr-client.key" + + check_overwrite "${SSH_DIR}/rtr-authorized_keys" + cp "${SSH_DIR}/rtr-client.key.pub" "${SSH_DIR}/rtr-authorized_keys" + info "created SSH authorized_keys: ${SSH_DIR}/rtr-authorized_keys" + + chmod 600 \ + "${SSH_DIR}/ssh_host_rsa_key" \ + "${SSH_DIR}/rtr-client.key" + chmod 644 "${SSH_DIR}"/*.pub "${SSH_DIR}/rtr-authorized_keys" +} + +while [[ $# -gt 0 ]]; do + case "$1" in + --out-dir) + [[ $# -ge 2 ]] || die "--out-dir requires a value" + OUT_DIR="$2" + shift 2 + ;; + --server-dns) + [[ $# -ge 2 ]] || die "--server-dns requires a value" + SERVER_DNS="$2" + shift 2 + ;; + --tls-only) + DO_TLS=1 + DO_SSH=0 + shift + ;; + --ssh-only) + DO_TLS=0 + DO_SSH=1 + shift + ;; + --force) + FORCE=1 + shift + ;; + -h|--help) + usage + exit 0 + ;; + *) + die "unknown option: $1" + ;; + esac +done + +ensure_abs_out_dir + +if [[ "${DO_TLS}" == "1" ]]; then + generate_tls +fi + +if [[ "${DO_SSH}" == "1" ]]; then + generate_ssh +fi + +info "done" +info "generated files under ${OUT_DIR}" + +if [[ "${DO_TLS}" == "1" ]]; then + cat <&2 +} + +stage() { + printf '\n====== %s ======\n' "$*" >&2 +} + +die() { + printf '[11_start_client] ERROR: %s\n' "$*" >&2 + exit 1 +} + +set_env_var() { + local env_file="$1" + local key="$2" + local value="$3" + local tmp_file + + tmp_file="${env_file}.tmp.$$" + awk -v key="${key}" -v value="${value}" ' + BEGIN { done = 0 } + $0 ~ "^[[:space:]]*#?[[:space:]]*" key "=" { + if (!done) { + print key "=" value + done = 1 + } + next + } + { print } + END { + if (!done) { + print key "=" value + } + } + ' "${env_file}" >"${tmp_file}" + mv "${tmp_file}" "${env_file}" +} + +compose_file_for_mode() { + case "$1" in + tcp) printf '%s\n' "${ROOT_DIR}/deploy/client/docker-compose.tcp.yml" ;; + tls) printf '%s\n' "${ROOT_DIR}/deploy/client/docker-compose.tls.yml" ;; + ssh) printf '%s\n' "${ROOT_DIR}/deploy/client/docker-compose.ssh.yml" ;; + *) die "unsupported mode '$1', expected tcp|tls|ssh" ;; + esac +} + +while [ "$#" -gt 0 ]; do + case "$1" in + --mode) + [ "$#" -ge 2 ] || die "--mode requires a value" + MODE="$2" + shift 2 + ;; + --env) + [ "$#" -ge 2 ] || die "--env requires a value" + COMMON_ENV_FILE="$2" + shift 2 + ;; + -h|--help) + usage + exit 0 + ;; + *) + die "unknown option: $1" + ;; + esac +done + +CLIENT_COMPOSE_FILE="$(compose_file_for_mode "${MODE}")" + +stage "Checking Docker" +command -v docker >/dev/null 2>&1 || die "docker command not found" +if docker compose version >/dev/null 2>&1; then + COMPOSE_BIN=(docker compose) +elif command -v docker-compose >/dev/null 2>&1 && docker-compose version >/dev/null 2>&1; then + COMPOSE_BIN=(docker-compose) +else + die "docker compose is not available" +fi + +[ -f "${CLIENT_ENV_FILE}" ] || die "deploy client env file not found: ${CLIENT_ENV_FILE}" +[ -f "${CLIENT_COMPOSE_FILE}" ] || die "client compose file not found: ${CLIENT_COMPOSE_FILE}" + +stage "Reading Client Environment" +if [ -f "${COMMON_ENV_FILE}" ]; then + updated_count=0 + while IFS= read -r line || [ -n "${line}" ]; do + case "${line}" in + ''|\#*) continue ;; + *=*) + key="${line%%=*}" + value="${line#*=}" + set_env_var "${CLIENT_ENV_FILE}" "${key}" "${value}" + updated_count=$((updated_count + 1)) + ;; + esac + done <"${COMMON_ENV_FILE}" + log "updated ${updated_count} client env variable(s)" +else + log "environment.client file not found, skip env update" +fi + +stage "Starting RTR Debug Client" +log "mode: ${MODE}" +"${COMPOSE_BIN[@]}" --env-file "${CLIENT_ENV_FILE}" -p "${COMPOSE_PROJECT}" -f "${CLIENT_COMPOSE_FILE}" up -d --no-build rtr-debug-client + +log "checking client compose status" +"${COMPOSE_BIN[@]}" --env-file "${CLIENT_ENV_FILE}" -p "${COMPOSE_PROJECT}" -f "${CLIENT_COMPOSE_FILE}" ps rtr-debug-client + +stage "Client Started" diff --git a/scripts/12_shutdown_client.sh b/scripts/12_shutdown_client.sh new file mode 100644 index 0000000..47f67ce --- /dev/null +++ b/scripts/12_shutdown_client.sh @@ -0,0 +1,82 @@ +#!/usr/bin/env bash +set -euo pipefail + +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +ROOT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)" + +CLIENT_ENV_FILE="${ROOT_DIR}/deploy/client/.env" +MODE="${RPKI_RTR_CLIENT_MODE:-tcp}" +COMPOSE_PROJECT="${RPKI_RTR_CLIENT_COMPOSE_PROJECT:-rpki-rtr-client}" + +usage() { + cat <<'EOF' +Usage: scripts/12_shutdown_client.sh [options] + +Stop the RTR debug client started by scripts/11_start_client.sh. + +Options: + --mode MODE Client mode: tcp|tls|ssh. Default: tcp + -h, --help Show this help. +EOF +} + +log() { + printf '[12_shutdown_client] %s\n' "$*" >&2 +} + +stage() { + printf '\n====== %s ======\n' "$*" >&2 +} + +die() { + printf '[12_shutdown_client] ERROR: %s\n' "$*" >&2 + exit 1 +} + +compose_file_for_mode() { + case "$1" in + tcp) printf '%s\n' "${ROOT_DIR}/deploy/client/docker-compose.tcp.yml" ;; + tls) printf '%s\n' "${ROOT_DIR}/deploy/client/docker-compose.tls.yml" ;; + ssh) printf '%s\n' "${ROOT_DIR}/deploy/client/docker-compose.ssh.yml" ;; + *) die "unsupported mode '$1', expected tcp|tls|ssh" ;; + esac +} + +while [ "$#" -gt 0 ]; do + case "$1" in + --mode) + [ "$#" -ge 2 ] || die "--mode requires a value" + MODE="$2" + shift 2 + ;; + -h|--help) + usage + exit 0 + ;; + *) + die "unknown option: $1" + ;; + esac +done + +CLIENT_COMPOSE_FILE="$(compose_file_for_mode "${MODE}")" + +stage "Checking Docker" +command -v docker >/dev/null 2>&1 || die "docker command not found" +if docker compose version >/dev/null 2>&1; then + COMPOSE_BIN=(docker compose) +elif command -v docker-compose >/dev/null 2>&1 && docker-compose version >/dev/null 2>&1; then + COMPOSE_BIN=(docker-compose) +else + die "docker compose is not available" +fi + +stage "Stopping RTR Debug Client" +log "mode: ${MODE}" +if [ -f "${CLIENT_ENV_FILE}" ] && [ -f "${CLIENT_COMPOSE_FILE}" ]; then + "${COMPOSE_BIN[@]}" --env-file "${CLIENT_ENV_FILE}" -p "${COMPOSE_PROJECT}" -f "${CLIENT_COMPOSE_FILE}" down --remove-orphans +else + log "client compose/env not found, skip" +fi + +stage "Client Shutdown Finished" diff --git a/scripts/start-rtr-server-tcp.sh b/scripts/start-rtr-server-tcp.sh deleted file mode 100644 index e24fa01..0000000 --- a/scripts/start-rtr-server-tcp.sh +++ /dev/null @@ -1,34 +0,0 @@ -#!/usr/bin/env sh -set -eu - -: "${RPKI_RTR_ENABLE_TLS:=false}" -: "${RPKI_RTR_TCP_ADDR:=0.0.0.0:323}" -export RPKI_RTR_ENABLE_TLS -export RPKI_RTR_TCP_ADDR - -: "${RPKI_RTR_DB_PATH:=./rtr-db}" -: "${RPKI_RTR_CCR_DIR:=./data}" -export RPKI_RTR_DB_PATH -export RPKI_RTR_CCR_DIR - -: "${RPKI_RTR_MAX_DELTA:=100}" -: "${RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS:=300}" -: "${RPKI_RTR_TIMING_REFRESH_SECS:=3600}" -: "${RPKI_RTR_TIMING_RETRY_SECS:=600}" -: "${RPKI_RTR_TIMING_EXPIRE_SECS:=7200}" -: "${RPKI_RTR_MAX_CONNECTIONS:=512}" -: "${RPKI_RTR_NOTIFY_QUEUE_SIZE:=1024}" -export RPKI_RTR_MAX_DELTA -export RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS -export RPKI_RTR_TIMING_REFRESH_SECS -export RPKI_RTR_TIMING_RETRY_SECS -export RPKI_RTR_TIMING_EXPIRE_SECS -export RPKI_RTR_MAX_CONNECTIONS -export RPKI_RTR_NOTIFY_QUEUE_SIZE - -: "${RPKI_RTR_TCP_KEEPALIVE_SECS:=60}" -: "${RPKI_RTR_WARN_INSECURE_TCP:=true}" -export RPKI_RTR_TCP_KEEPALIVE_SECS -export RPKI_RTR_WARN_INSECURE_TCP - -cargo run diff --git a/scripts/start-rtr-server-tls.sh b/scripts/start-rtr-server-tls.sh deleted file mode 100644 index 1946de9..0000000 --- a/scripts/start-rtr-server-tls.sh +++ /dev/null @@ -1,45 +0,0 @@ -#!/usr/bin/env sh -set -eu - -: "${RPKI_RTR_ENABLE_TLS:=true}" -: "${RPKI_RTR_TCP_ADDR:=0.0.0.0:323}" -: "${RPKI_RTR_TLS_ADDR:=0.0.0.0:324}" -export RPKI_RTR_ENABLE_TLS -export RPKI_RTR_TCP_ADDR -export RPKI_RTR_TLS_ADDR - -: "${RPKI_RTR_DB_PATH:=./rtr-db}" -: "${RPKI_RTR_CCR_DIR:=./data}" -export RPKI_RTR_DB_PATH -export RPKI_RTR_CCR_DIR - -: "${RPKI_RTR_TLS_CERT_PATH:=./certs/server-dns.crt}" -: "${RPKI_RTR_TLS_KEY_PATH:=./certs/server-dns.key}" -: "${RPKI_RTR_TLS_CLIENT_CA_PATH:=./certs/client-ca.crt}" -export RPKI_RTR_TLS_CERT_PATH -export RPKI_RTR_TLS_KEY_PATH -export RPKI_RTR_TLS_CLIENT_CA_PATH - -: "${RPKI_RTR_MAX_DELTA:=100}" -: "${RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS:=300}" -: "${RPKI_RTR_TIMING_REFRESH_SECS:=3600}" -: "${RPKI_RTR_TIMING_RETRY_SECS:=600}" -: "${RPKI_RTR_TIMING_EXPIRE_SECS:=7200}" -: "${RPKI_RTR_MAX_CONNECTIONS:=512}" -: "${RPKI_RTR_NOTIFY_QUEUE_SIZE:=1024}" -export RPKI_RTR_MAX_DELTA -export RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS -export RPKI_RTR_TIMING_REFRESH_SECS -export RPKI_RTR_TIMING_RETRY_SECS -export RPKI_RTR_TIMING_EXPIRE_SECS -export RPKI_RTR_MAX_CONNECTIONS -export RPKI_RTR_NOTIFY_QUEUE_SIZE - -: "${RPKI_RTR_TCP_KEEPALIVE_SECS:=60}" -: "${RPKI_RTR_WARN_INSECURE_TCP:=true}" -: "${RPKI_RTR_REQUIRE_TLS_SERVER_DNS_NAME_SAN:=true}" -export RPKI_RTR_TCP_KEEPALIVE_SECS -export RPKI_RTR_WARN_INSECURE_TCP -export RPKI_RTR_REQUIRE_TLS_SERVER_DNS_NAME_SAN - -cargo run diff --git a/scripts/start-rtr-server.sh b/scripts/start-rtr-server.sh deleted file mode 100644 index 1946de9..0000000 --- a/scripts/start-rtr-server.sh +++ /dev/null @@ -1,45 +0,0 @@ -#!/usr/bin/env sh -set -eu - -: "${RPKI_RTR_ENABLE_TLS:=true}" -: "${RPKI_RTR_TCP_ADDR:=0.0.0.0:323}" -: "${RPKI_RTR_TLS_ADDR:=0.0.0.0:324}" -export RPKI_RTR_ENABLE_TLS -export RPKI_RTR_TCP_ADDR -export RPKI_RTR_TLS_ADDR - -: "${RPKI_RTR_DB_PATH:=./rtr-db}" -: "${RPKI_RTR_CCR_DIR:=./data}" -export RPKI_RTR_DB_PATH -export RPKI_RTR_CCR_DIR - -: "${RPKI_RTR_TLS_CERT_PATH:=./certs/server-dns.crt}" -: "${RPKI_RTR_TLS_KEY_PATH:=./certs/server-dns.key}" -: "${RPKI_RTR_TLS_CLIENT_CA_PATH:=./certs/client-ca.crt}" -export RPKI_RTR_TLS_CERT_PATH -export RPKI_RTR_TLS_KEY_PATH -export RPKI_RTR_TLS_CLIENT_CA_PATH - -: "${RPKI_RTR_MAX_DELTA:=100}" -: "${RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS:=300}" -: "${RPKI_RTR_TIMING_REFRESH_SECS:=3600}" -: "${RPKI_RTR_TIMING_RETRY_SECS:=600}" -: "${RPKI_RTR_TIMING_EXPIRE_SECS:=7200}" -: "${RPKI_RTR_MAX_CONNECTIONS:=512}" -: "${RPKI_RTR_NOTIFY_QUEUE_SIZE:=1024}" -export RPKI_RTR_MAX_DELTA -export RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS -export RPKI_RTR_TIMING_REFRESH_SECS -export RPKI_RTR_TIMING_RETRY_SECS -export RPKI_RTR_TIMING_EXPIRE_SECS -export RPKI_RTR_MAX_CONNECTIONS -export RPKI_RTR_NOTIFY_QUEUE_SIZE - -: "${RPKI_RTR_TCP_KEEPALIVE_SECS:=60}" -: "${RPKI_RTR_WARN_INSECURE_TCP:=true}" -: "${RPKI_RTR_REQUIRE_TLS_SERVER_DNS_NAME_SAN:=true}" -export RPKI_RTR_TCP_KEEPALIVE_SECS -export RPKI_RTR_WARN_INSECURE_TCP -export RPKI_RTR_REQUIRE_TLS_SERVER_DNS_NAME_SAN - -cargo run