20260330 完成live bundle录制，远程录制，以及与routinator/rpki-client replay对比
This commit is contained in:
454
src/bin/replay_bundle_capture.rs
Normal file
454
src/bin/replay_bundle_capture.rs
Normal file
@@ -0,0 +1,454 @@
|
||||
use rpki::bundle::{
|
||||
BundleManifest, BundleManifestEntry, RirBundleMetadata, RecordingHttpFetcher,
|
||||
RecordingRsyncFetcher, build_vap_compare_rows, build_vrp_compare_rows,
|
||||
write_live_base_replay_bundle_inputs, write_vap_csv, write_vrp_csv,
|
||||
};
|
||||
use rpki::ccr::{build_ccr_from_run, verify_content_info, write_ccr_file};
|
||||
use rpki::fetch::http::{BlockingHttpFetcher, HttpFetcherConfig};
|
||||
use rpki::fetch::rsync_system::{SystemRsyncConfig, SystemRsyncFetcher};
|
||||
use rpki::policy::Policy;
|
||||
use rpki::storage::RocksStore;
|
||||
use rpki::validation::run_tree_from_tal::{
|
||||
run_tree_from_tal_and_ta_der_payload_replay_serial_audit,
|
||||
run_tree_from_tal_and_ta_der_serial_audit,
|
||||
};
|
||||
use rpki::validation::tree::TreeRunConfig;
|
||||
use sha2::Digest;
|
||||
use std::fs;
|
||||
use std::path::{Path, PathBuf};
|
||||
use std::time::Instant;
|
||||
use time::format_description::well_known::Rfc3339;
|
||||
|
||||
#[derive(Debug, Default, PartialEq, Eq)]
|
||||
struct Args {
|
||||
rir: Option<String>,
|
||||
out_dir: Option<PathBuf>,
|
||||
tal_path: Option<PathBuf>,
|
||||
ta_path: Option<PathBuf>,
|
||||
validation_time: Option<time::OffsetDateTime>,
|
||||
http_timeout_secs: u64,
|
||||
rsync_timeout_secs: u64,
|
||||
rsync_mirror_root: Option<PathBuf>,
|
||||
max_depth: Option<usize>,
|
||||
max_instances: Option<usize>,
|
||||
trust_anchor: Option<String>,
|
||||
}
|
||||
|
||||
fn usage() -> &'static str {
|
||||
"Usage: replay_bundle_capture --rir <name> --out-dir <path> --tal-path <path> --ta-path <path> [--validation-time <rfc3339>] [--http-timeout-secs <n>] [--rsync-timeout-secs <n>] [--rsync-mirror-root <path>] [--max-depth <n>] [--max-instances <n>] [--trust-anchor <name>]"
|
||||
}
|
||||
|
||||
fn parse_args(argv: &[String]) -> Result<Args, String> {
|
||||
let mut args = Args {
|
||||
http_timeout_secs: 20,
|
||||
rsync_timeout_secs: 60,
|
||||
..Args::default()
|
||||
};
|
||||
let mut i = 1usize;
|
||||
while i < argv.len() {
|
||||
match argv[i].as_str() {
|
||||
"--help" | "-h" => return Err(usage().to_string()),
|
||||
"--rir" => {
|
||||
i += 1;
|
||||
args.rir = Some(argv.get(i).ok_or("--rir requires a value")?.clone());
|
||||
}
|
||||
"--out-dir" => {
|
||||
i += 1;
|
||||
args.out_dir = Some(PathBuf::from(argv.get(i).ok_or("--out-dir requires a value")?));
|
||||
}
|
||||
"--tal-path" => {
|
||||
i += 1;
|
||||
args.tal_path = Some(PathBuf::from(argv.get(i).ok_or("--tal-path requires a value")?));
|
||||
}
|
||||
"--ta-path" => {
|
||||
i += 1;
|
||||
args.ta_path = Some(PathBuf::from(argv.get(i).ok_or("--ta-path requires a value")?));
|
||||
}
|
||||
"--validation-time" => {
|
||||
i += 1;
|
||||
let value = argv.get(i).ok_or("--validation-time requires a value")?;
|
||||
args.validation_time = Some(
|
||||
time::OffsetDateTime::parse(value, &Rfc3339)
|
||||
.map_err(|e| format!("invalid --validation-time: {e}"))?,
|
||||
);
|
||||
}
|
||||
"--http-timeout-secs" => {
|
||||
i += 1;
|
||||
args.http_timeout_secs = argv
|
||||
.get(i)
|
||||
.ok_or("--http-timeout-secs requires a value")?
|
||||
.parse()
|
||||
.map_err(|e| format!("invalid --http-timeout-secs: {e}"))?;
|
||||
}
|
||||
"--rsync-timeout-secs" => {
|
||||
i += 1;
|
||||
args.rsync_timeout_secs = argv
|
||||
.get(i)
|
||||
.ok_or("--rsync-timeout-secs requires a value")?
|
||||
.parse()
|
||||
.map_err(|e| format!("invalid --rsync-timeout-secs: {e}"))?;
|
||||
}
|
||||
"--rsync-mirror-root" => {
|
||||
i += 1;
|
||||
args.rsync_mirror_root =
|
||||
Some(PathBuf::from(argv.get(i).ok_or("--rsync-mirror-root requires a value")?));
|
||||
}
|
||||
"--max-depth" => {
|
||||
i += 1;
|
||||
args.max_depth = Some(
|
||||
argv.get(i)
|
||||
.ok_or("--max-depth requires a value")?
|
||||
.parse()
|
||||
.map_err(|e| format!("invalid --max-depth: {e}"))?,
|
||||
);
|
||||
}
|
||||
"--max-instances" => {
|
||||
i += 1;
|
||||
args.max_instances = Some(
|
||||
argv.get(i)
|
||||
.ok_or("--max-instances requires a value")?
|
||||
.parse()
|
||||
.map_err(|e| format!("invalid --max-instances: {e}"))?,
|
||||
);
|
||||
}
|
||||
"--trust-anchor" => {
|
||||
i += 1;
|
||||
args.trust_anchor = Some(argv.get(i).ok_or("--trust-anchor requires a value")?.clone());
|
||||
}
|
||||
other => return Err(format!("unknown argument: {other}\n{}", usage())),
|
||||
}
|
||||
i += 1;
|
||||
}
|
||||
|
||||
if args.rir.is_none() {
|
||||
return Err(format!("--rir is required\n{}", usage()));
|
||||
}
|
||||
if args.out_dir.is_none() {
|
||||
return Err(format!("--out-dir is required\n{}", usage()));
|
||||
}
|
||||
if args.tal_path.is_none() {
|
||||
return Err(format!("--tal-path is required\n{}", usage()));
|
||||
}
|
||||
if args.ta_path.is_none() {
|
||||
return Err(format!("--ta-path is required\n{}", usage()));
|
||||
}
|
||||
Ok(args)
|
||||
}
|
||||
|
||||
fn sha256_hex(bytes: &[u8]) -> String {
|
||||
hex::encode(sha2::Sha256::digest(bytes))
|
||||
}
|
||||
|
||||
fn write_json(path: &Path, value: &impl serde::Serialize) -> Result<(), String> {
|
||||
if let Some(parent) = path.parent() {
|
||||
fs::create_dir_all(parent)
|
||||
.map_err(|e| format!("create parent failed: {}: {e}", parent.display()))?;
|
||||
}
|
||||
let bytes = serde_json::to_vec_pretty(value).map_err(|e| e.to_string())?;
|
||||
fs::write(path, bytes).map_err(|e| format!("write json failed: {}: {e}", path.display()))
|
||||
}
|
||||
|
||||
fn write_timing_json(
|
||||
path: &Path,
|
||||
mode: &str,
|
||||
validation_time: &time::OffsetDateTime,
|
||||
duration: std::time::Duration,
|
||||
) -> Result<(), String> {
|
||||
write_json(
|
||||
path,
|
||||
&serde_json::json!({
|
||||
"mode": mode,
|
||||
"validationTime": validation_time
|
||||
.format(&Rfc3339)
|
||||
.map_err(|e| format!("format validation time failed: {e}"))?,
|
||||
"durationSeconds": duration.as_secs_f64(),
|
||||
}),
|
||||
)
|
||||
}
|
||||
|
||||
fn write_top_readme(path: &Path, rir: &str) -> Result<(), String> {
|
||||
fs::write(
|
||||
path,
|
||||
format!(
|
||||
"# Ours Live Replay Bundle\n\nThis run contains one per-RIR bundle recorded online by `ours`.\n\n- RIR: `{rir}`\n- Reference result format: `CCR`\n"
|
||||
),
|
||||
)
|
||||
.map_err(|e| format!("write readme failed: {}: {e}", path.display()))
|
||||
}
|
||||
|
||||
fn write_rir_readme(path: &Path, rir: &str, base_validation_time: &str) -> Result<(), String> {
|
||||
fs::write(
|
||||
path,
|
||||
format!(
|
||||
"# {rir} live replay bundle\n\n- `tal.tal` and `ta.cer` are the actual live run inputs.\n- `base-locks.json.validationTime` = `{base_validation_time}`.\n- `base.ccr` is the authoritative reference result.\n- `base-vrps.csv` and `base-vaps.csv` are compare views derived from `base.ccr`.\n"
|
||||
),
|
||||
)
|
||||
.map_err(|e| format!("write rir readme failed: {}: {e}", path.display()))
|
||||
}
|
||||
|
||||
fn run(args: Args) -> Result<PathBuf, String> {
|
||||
let rir = args.rir.as_ref().unwrap();
|
||||
let rir_normalized = rir.to_ascii_lowercase();
|
||||
let trust_anchor = args
|
||||
.trust_anchor
|
||||
.clone()
|
||||
.unwrap_or_else(|| rir_normalized.clone());
|
||||
let out_root = args.out_dir.as_ref().unwrap();
|
||||
let rir_dir = out_root.join(&rir_normalized);
|
||||
fs::create_dir_all(&rir_dir)
|
||||
.map_err(|e| format!("create rir dir failed: {}: {e}", rir_dir.display()))?;
|
||||
|
||||
let tal_bytes = fs::read(args.tal_path.as_ref().unwrap())
|
||||
.map_err(|e| format!("read tal failed: {e}"))?;
|
||||
let ta_bytes = fs::read(args.ta_path.as_ref().unwrap())
|
||||
.map_err(|e| format!("read ta failed: {e}"))?;
|
||||
let validation_time = args.validation_time.unwrap_or_else(time::OffsetDateTime::now_utc);
|
||||
|
||||
let db_dir = out_root.join(".tmp").join(format!("{rir}-live-base-db"));
|
||||
let replay_db_dir = out_root.join(".tmp").join(format!("{rir}-self-replay-db"));
|
||||
let _ = fs::remove_dir_all(&db_dir);
|
||||
let _ = fs::remove_dir_all(&replay_db_dir);
|
||||
if let Some(parent) = db_dir.parent() {
|
||||
fs::create_dir_all(parent)
|
||||
.map_err(|e| format!("create tmp dir failed: {}: {e}", parent.display()))?;
|
||||
}
|
||||
|
||||
let store = RocksStore::open(&db_dir).map_err(|e| format!("open rocksdb failed: {e}"))?;
|
||||
let http = RecordingHttpFetcher::new(
|
||||
BlockingHttpFetcher::new(HttpFetcherConfig {
|
||||
timeout: std::time::Duration::from_secs(args.http_timeout_secs),
|
||||
..HttpFetcherConfig::default()
|
||||
})
|
||||
.map_err(|e| format!("create http fetcher failed: {e}"))?,
|
||||
);
|
||||
let rsync = RecordingRsyncFetcher::new(SystemRsyncFetcher::new(SystemRsyncConfig {
|
||||
timeout: std::time::Duration::from_secs(args.rsync_timeout_secs),
|
||||
mirror_root: args.rsync_mirror_root.clone(),
|
||||
..SystemRsyncConfig::default()
|
||||
}));
|
||||
|
||||
let started = Instant::now();
|
||||
let out = run_tree_from_tal_and_ta_der_serial_audit(
|
||||
&store,
|
||||
&Policy::default(),
|
||||
&tal_bytes,
|
||||
&ta_bytes,
|
||||
None,
|
||||
&http,
|
||||
&rsync,
|
||||
validation_time,
|
||||
&TreeRunConfig {
|
||||
max_depth: args.max_depth,
|
||||
max_instances: args.max_instances,
|
||||
},
|
||||
)
|
||||
.map_err(|e| format!("live base run failed: {e}"))?;
|
||||
let duration = started.elapsed();
|
||||
|
||||
let ccr = build_ccr_from_run(
|
||||
&store,
|
||||
&[out.discovery.trust_anchor.clone()],
|
||||
&out.tree.vrps,
|
||||
&out.tree.aspas,
|
||||
&out.tree.router_keys,
|
||||
validation_time,
|
||||
)
|
||||
.map_err(|e| format!("build ccr failed: {e}"))?;
|
||||
let base_ccr_path = rir_dir.join("base.ccr");
|
||||
write_ccr_file(&base_ccr_path, &ccr).map_err(|e| format!("write ccr failed: {e}"))?;
|
||||
let ccr_bytes =
|
||||
fs::read(&base_ccr_path).map_err(|e| format!("read written ccr failed: {}: {e}", base_ccr_path.display()))?;
|
||||
let decoded = rpki::ccr::decode_content_info(&ccr_bytes)
|
||||
.map_err(|e| format!("decode written ccr failed: {e}"))?;
|
||||
let verify = verify_content_info(&decoded).map_err(|e| format!("verify ccr failed: {e}"))?;
|
||||
|
||||
let vrp_rows = build_vrp_compare_rows(&out.tree.vrps, &trust_anchor);
|
||||
let vap_rows = build_vap_compare_rows(&out.tree.aspas, &trust_anchor);
|
||||
let (ccr_vrps, ccr_vaps) = rpki::bundle::decode_ccr_compare_views(&decoded, &trust_anchor)?;
|
||||
if vrp_rows != ccr_vrps {
|
||||
return Err("base-vrps compare view does not match base.ccr".to_string());
|
||||
}
|
||||
if vap_rows != ccr_vaps {
|
||||
return Err("base-vaps compare view does not match base.ccr".to_string());
|
||||
}
|
||||
write_vrp_csv(&rir_dir.join("base-vrps.csv"), &vrp_rows)?;
|
||||
write_vap_csv(&rir_dir.join("base-vaps.csv"), &vap_rows)?;
|
||||
|
||||
fs::write(rir_dir.join("tal.tal"), &tal_bytes).map_err(|e| format!("write tal failed: {e}"))?;
|
||||
fs::write(rir_dir.join("ta.cer"), &ta_bytes).map_err(|e| format!("write ta failed: {e}"))?;
|
||||
let capture = write_live_base_replay_bundle_inputs(
|
||||
&rir_dir,
|
||||
&rir_normalized,
|
||||
validation_time,
|
||||
&out.publication_points,
|
||||
&store,
|
||||
&http.snapshot_responses(),
|
||||
&rsync.snapshot_fetches(),
|
||||
)?;
|
||||
|
||||
let replay_store =
|
||||
RocksStore::open(&replay_db_dir).map_err(|e| format!("open self replay rocksdb failed: {e}"))?;
|
||||
let replay_out = run_tree_from_tal_and_ta_der_payload_replay_serial_audit(
|
||||
&replay_store,
|
||||
&Policy::default(),
|
||||
&tal_bytes,
|
||||
&ta_bytes,
|
||||
None,
|
||||
&rir_dir.join("base-payload-archive"),
|
||||
&rir_dir.join("base-locks.json"),
|
||||
validation_time,
|
||||
&TreeRunConfig {
|
||||
max_depth: args.max_depth,
|
||||
max_instances: args.max_instances,
|
||||
},
|
||||
)
|
||||
.map_err(|e| format!("self replay failed: {e}"))?;
|
||||
let replay_vrps = build_vrp_compare_rows(&replay_out.tree.vrps, &trust_anchor);
|
||||
let replay_vaps = build_vap_compare_rows(&replay_out.tree.aspas, &trust_anchor);
|
||||
if replay_vrps != vrp_rows {
|
||||
return Err("self replay VRP compare view mismatch".to_string());
|
||||
}
|
||||
if replay_vaps != vap_rows {
|
||||
return Err("self replay VAP compare view mismatch".to_string());
|
||||
}
|
||||
|
||||
fs::create_dir_all(rir_dir.join("timings"))
|
||||
.map_err(|e| format!("create timings dir failed: {e}"))?;
|
||||
write_timing_json(
|
||||
&rir_dir.join("timings").join("base-produce.json"),
|
||||
"base",
|
||||
&validation_time,
|
||||
duration,
|
||||
)?;
|
||||
|
||||
let metadata = RirBundleMetadata {
|
||||
schema_version: "20260330-v1".to_string(),
|
||||
bundle_producer: "ours".to_string(),
|
||||
rir: rir_normalized.clone(),
|
||||
base_validation_time: validation_time
|
||||
.format(&Rfc3339)
|
||||
.map_err(|e| format!("format validation time failed: {e}"))?,
|
||||
delta_validation_time: None,
|
||||
tal_sha256: sha256_hex(&tal_bytes),
|
||||
ta_cert_sha256: sha256_hex(&ta_bytes),
|
||||
base_ccr_sha256: sha256_hex(&ccr_bytes),
|
||||
delta_ccr_sha256: None,
|
||||
has_aspa: !vap_rows.is_empty(),
|
||||
has_router_key: verify.router_key_count > 0,
|
||||
base_vrp_count: vrp_rows.len(),
|
||||
base_vap_count: vap_rows.len(),
|
||||
delta_vrp_count: None,
|
||||
delta_vap_count: None,
|
||||
};
|
||||
write_json(&rir_dir.join("bundle.json"), &metadata)?;
|
||||
write_json(
|
||||
&rir_dir.join("verification.json"),
|
||||
&serde_json::json!({
|
||||
"base": {
|
||||
"validationTime": metadata.base_validation_time,
|
||||
"ccr": {
|
||||
"path": "base.ccr",
|
||||
"sha256": metadata.base_ccr_sha256,
|
||||
"stateHashesOk": verify.state_hashes_ok,
|
||||
"manifestInstances": verify.manifest_instances,
|
||||
"roaVrpCount": verify.roa_vrp_count,
|
||||
"aspaPayloadSets": verify.aspa_payload_sets,
|
||||
"routerKeyCount": verify.router_key_count,
|
||||
},
|
||||
"compareViews": {
|
||||
"vrpsSelfMatch": true,
|
||||
"vapsSelfMatch": true,
|
||||
"baseVrpCount": metadata.base_vrp_count,
|
||||
"baseVapCount": metadata.base_vap_count,
|
||||
},
|
||||
"capture": {
|
||||
"captureId": capture.capture_id,
|
||||
"rrdpRepoCount": capture.rrdp_repo_count,
|
||||
"rsyncModuleCount": capture.rsync_module_count,
|
||||
"selfReplayOk": true,
|
||||
}
|
||||
}
|
||||
}),
|
||||
)?;
|
||||
write_top_readme(&out_root.join("README.md"), &rir_normalized)?;
|
||||
write_rir_readme(&rir_dir.join("README.md"), &rir_normalized, &metadata.base_validation_time)?;
|
||||
write_json(
|
||||
&out_root.join("bundle-manifest.json"),
|
||||
&BundleManifest {
|
||||
schema_version: "20260330-v1".to_string(),
|
||||
bundle_producer: "ours".to_string(),
|
||||
recorded_at_rfc3339_utc: time::OffsetDateTime::now_utc()
|
||||
.format(&Rfc3339)
|
||||
.map_err(|e| format!("format recorded_at failed: {e}"))?,
|
||||
rirs: vec![rir_normalized.clone()],
|
||||
per_rir_bundles: vec![BundleManifestEntry {
|
||||
rir: rir_normalized.clone(),
|
||||
relative_path: rir_normalized,
|
||||
base_validation_time: metadata.base_validation_time.clone(),
|
||||
delta_validation_time: None,
|
||||
has_aspa: metadata.has_aspa,
|
||||
}],
|
||||
},
|
||||
)?;
|
||||
|
||||
let _ = fs::remove_dir_all(&db_dir);
|
||||
let _ = fs::remove_dir_all(&replay_db_dir);
|
||||
|
||||
Ok(out_root.clone())
|
||||
}
|
||||
|
||||
fn main() -> Result<(), String> {
|
||||
let args = parse_args(&std::env::args().collect::<Vec<_>>())?;
|
||||
let out = run(args)?;
|
||||
println!("{}", out.display());
|
||||
Ok(())
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use tempfile::tempdir;
|
||||
|
||||
#[test]
|
||||
fn parse_args_requires_required_flags() {
|
||||
let argv = vec![
|
||||
"replay_bundle_capture".to_string(),
|
||||
"--rir".to_string(),
|
||||
"apnic".to_string(),
|
||||
"--out-dir".to_string(),
|
||||
"out".to_string(),
|
||||
"--tal-path".to_string(),
|
||||
"tal".to_string(),
|
||||
"--ta-path".to_string(),
|
||||
"ta".to_string(),
|
||||
];
|
||||
let args = parse_args(&argv).expect("parse");
|
||||
assert_eq!(args.rir.as_deref(), Some("apnic"));
|
||||
assert_eq!(args.out_dir.as_deref(), Some(Path::new("out")));
|
||||
assert_eq!(args.http_timeout_secs, 20);
|
||||
assert_eq!(args.rsync_timeout_secs, 60);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn parse_args_rejects_missing_requireds() {
|
||||
let err = parse_args(&["replay_bundle_capture".to_string()]).unwrap_err();
|
||||
assert!(err.contains("--rir is required"), "{err}");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn write_timing_json_writes_duration_and_mode() {
|
||||
let td = tempdir().expect("tempdir");
|
||||
let path = td.path().join("timings/base-produce.json");
|
||||
write_timing_json(
|
||||
&path,
|
||||
"base",
|
||||
&time::OffsetDateTime::parse("2026-03-30T00:00:00Z", &Rfc3339).expect("time"),
|
||||
std::time::Duration::from_millis(1500),
|
||||
)
|
||||
.expect("write timing");
|
||||
let json: serde_json::Value =
|
||||
serde_json::from_slice(&std::fs::read(&path).expect("read timing")).expect("parse");
|
||||
assert_eq!(json["mode"], "base");
|
||||
assert_eq!(json["durationSeconds"], 1.5);
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user