NASP/rpki
84
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

20260623 细化ROA cache CRL gate

Browse Source
This commit is contained in:
yuyr
2026-06-24 00:05:14 +08:00
parent 574e40a4d4
commit 8c4a677ffa
9 changed files with 1031 additions and 338 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1014
src/validation/objects.rs
View File

File diff suppressed because it is too large Load Diff

3
src/validation/tree.rs
View File

@@ -410,6 +410,7 @@ mod tests {
stats: ObjectsStats::default(),
audit: Vec::new(),
roa_cache_stats: crate::validation::objects::RoaValidationCacheStats::default(),
roa_cache_object_meta: Vec::new(),
},
audit: PublicationPointAudit::default(),
cir_fresh_objects: Vec::new(),
@@ -496,6 +497,7 @@ mod tests {
audit: Vec::new(),
roa_cache_stats:
crate::validation::objects::RoaValidationCacheStats::default(),
roa_cache_object_meta: Vec::new(),
},
audit: PublicationPointAudit {
objects: vec![fresh_reject.clone(), cached.clone()],
@@ -528,6 +530,7 @@ mod tests {
audit: Vec::new(),
roa_cache_stats:
crate::validation::objects::RoaValidationCacheStats::default(),
roa_cache_object_meta: Vec::new(),
},
audit: PublicationPointAudit {
objects: vec![fresh],

9
src/validation/tree_parallel.rs
View File

@@ -1168,7 +1168,13 @@ fn stage_ready_publication_point(
None
};
let roa_cache = if runner.enable_roa_validation_cache && has_roa {
RoaValidationCacheInput::enabled(roa_cache_view.as_ref())
RoaValidationCacheInput::enabled_with_context(
roa_cache_view.as_ref(),
crate::validation::tree_runner::parent_context_digest_for_ca(&ready.node.handle),
crate::validation::tree_runner::publication_point_cache_policy_fingerprint(
runner.policy,
),
)
} else {
RoaValidationCacheInput::disabled()
};
@@ -2316,6 +2322,7 @@ mod tests {
stats: ObjectsStats::default(),
audit: Vec::new(),
roa_cache_stats: crate::validation::objects::RoaValidationCacheStats::default(),
roa_cache_object_meta: Vec::new(),
},
audit: PublicationPointAudit::default(),
cir_fresh_objects: Vec::new(),

70
src/validation/tree_runner.rs
View File

@@ -26,9 +26,9 @@ use crate::replay::delta_archive::ReplayDeltaArchiveIndex;
use crate::report::{RfcRef, Warning};
use crate::storage::{
PackFile, PackTime, PublicationPointCacheChild, PublicationPointCacheOutput,
PublicationPointCacheProjection, RawByHashEntry, RocksStore, ValidatedCaInstanceResult,
VcirArtifactKind, VcirArtifactRole, VcirArtifactValidationStatus, VcirAuditSummary,
VcirCcrManifestProjection, VcirChildEntry, VcirInstanceGate, VcirLocalOutput,
PublicationPointCacheProjection, RawByHashEntry, RoaCacheProjectionContext, RocksStore,
ValidatedCaInstanceResult, VcirArtifactKind, VcirArtifactRole, VcirArtifactValidationStatus,
VcirAuditSummary, VcirCcrManifestProjection, VcirChildEntry, VcirInstanceGate, VcirLocalOutput,
VcirLocalOutputPayload, VcirOutputType, VcirRelatedArtifact, VcirReplaceTimingBreakdown,
VcirSourceObjectType, VcirSummary,
};
@@ -1041,6 +1041,7 @@ impl<'a> Rpkiv1PublicationPointRunner<'a> {
// local_outputs_cache only exists to build/persist VCIR. Release it before the
// publication point result is retained for the rest of the run.
let _released_local_outputs = std::mem::take(&mut objects.local_outputs_cache);
let _released_roa_cache_object_meta = std::mem::take(&mut objects.roa_cache_object_meta);
let mut ccr_projection_build_ms = 0;
let mut ccr_append_ms = 0;
@@ -1460,7 +1461,11 @@ impl<'a> PublicationPointRunner for Rpkiv1PublicationPointRunner<'a> {
None
};
let roa_cache = if self.enable_roa_validation_cache && has_roa {
RoaValidationCacheInput::enabled(roa_cache_view.as_ref())
RoaValidationCacheInput::enabled_with_context(
roa_cache_view.as_ref(),
parent_context_digest_for_ca(ca),
publication_point_cache_policy_fingerprint(self.policy),
)
} else {
RoaValidationCacheInput::disabled()
};
@@ -1887,7 +1892,7 @@ fn ta_context_digest_for_ca(ca: &CaInstanceHandle) -> [u8; 32] {
])
}
fn parent_context_digest_for_ca(ca: &CaInstanceHandle) -> [u8; 32] {
pub(crate) fn parent_context_digest_for_ca(ca: &CaInstanceHandle) -> [u8; 32] {
hash_serialized_parts(&[
(
"version",
@@ -1913,7 +1918,7 @@ fn parent_context_digest_for_ca(ca: &CaInstanceHandle) -> [u8; 32] {
])
}
fn publication_point_cache_policy_fingerprint(policy: &Policy) -> [u8; 32] {
pub(crate) fn publication_point_cache_policy_fingerprint(policy: &Policy) -> [u8; 32] {
hash_serialized_parts(&[
("version", b"publication-point-cache-policy-v1".to_vec()),
("policy", cbor_or_debug_bytes(policy)),
@@ -3074,6 +3079,7 @@ fn empty_objects_output() -> crate::validation::objects::ObjectsOutput {
stats: crate::validation::objects::ObjectsStats::default(),
audit: Vec::new(),
roa_cache_stats: crate::validation::objects::RoaValidationCacheStats::default(),
roa_cache_object_meta: Vec::new(),
}
}
@@ -4183,8 +4189,13 @@ fn persist_vcir_for_fresh_result_with_timing(
None
};
let replace_timing = store
.replace_vcir_manifest_replay_meta_and_publication_point_cache_projection(
.replace_vcir_manifest_replay_meta_and_projections(
&vcir,
Some(&RoaCacheProjectionContext {
parent_context_digest: parent_context_digest_for_ca(ca),
policy_fingerprint: publication_point_cache_policy_fingerprint(policy),
object_meta: objects.roa_cache_object_meta.clone(),
}),
publication_point_cache_projection.as_ref(),
)
.map_err(|e| format!("store VCIR and manifest replay meta failed: {e}"))?;
@@ -4351,10 +4362,29 @@ fn take_or_build_vcir_local_outputs(
pack: &PublicationPointSnapshot,
objects: &mut crate::validation::objects::ObjectsOutput,
) -> Result<Vec<VcirLocalOutput>, String> {
if !objects.local_outputs_cache.is_empty() {
return Ok(std::mem::take(&mut objects.local_outputs_cache));
let mut cached_outputs = std::mem::take(&mut objects.local_outputs_cache);
if cached_outputs.is_empty() {
return build_vcir_local_outputs(ca, pack, objects);
}
build_vcir_local_outputs(ca, pack, objects)
let covered_roa_uris: HashSet<String> = cached_outputs
.iter()
.filter(|output| output.source_object_type == VcirSourceObjectType::Roa)
.map(|output| output.source_object_uri.clone())
.collect();
let covered_aspa_uris: HashSet<String> = cached_outputs
.iter()
.filter(|output| output.source_object_type == VcirSourceObjectType::Aspa)
.map(|output| output.source_object_uri.clone())
.collect();
cached_outputs.extend(build_vcir_local_outputs_excluding(
ca,
pack,
objects,
&covered_roa_uris,
&covered_aspa_uris,
)?);
Ok(cached_outputs)
}
fn build_vcir_ccr_manifest_projection_from_fresh(
@@ -4454,10 +4484,16 @@ fn build_vcir_local_outputs(
pack: &PublicationPointSnapshot,
objects: &crate::validation::objects::ObjectsOutput,
) -> Result<Vec<VcirLocalOutput>, String> {
if !objects.local_outputs_cache.is_empty() {
return Ok(objects.local_outputs_cache.clone());
}
build_vcir_local_outputs_excluding(_ca, pack, objects, &HashSet::new(), &HashSet::new())
}
fn build_vcir_local_outputs_excluding(
_ca: &CaInstanceHandle,
pack: &PublicationPointSnapshot,
objects: &crate::validation::objects::ObjectsOutput,
covered_roa_uris: &HashSet<String>,
covered_aspa_uris: &HashSet<String>,
) -> Result<Vec<VcirLocalOutput>, String> {
let accepted_roa_uris: HashSet<&str> = objects
.audit
.iter()
@@ -4476,7 +4512,9 @@ fn build_vcir_local_outputs(
let mut out = Vec::new();
for file in &pack.files {
let source_object_hash = sha256_hex_from_32(&file.sha256);
if accepted_roa_uris.contains(file.rsync_uri.as_str()) {
if accepted_roa_uris.contains(file.rsync_uri.as_str())
&& !covered_roa_uris.contains(file.rsync_uri.as_str())
{
let roa = RoaObject::decode_der(
file.bytes()
.map_err(|e| format!("load accepted ROA bytes for VCIR failed: {e}"))?,
@@ -4512,7 +4550,9 @@ fn build_vcir_local_outputs(
rule_hash: sha256_hex_to_32(&rule_hash),
});
}
} else if accepted_aspa_uris.contains(file.rsync_uri.as_str()) {
} else if accepted_aspa_uris.contains(file.rsync_uri.as_str())
&& !covered_aspa_uris.contains(file.rsync_uri.as_str())
{
let aspa = AspaObject::decode_der(
file.bytes()
.map_err(|e| format!("load accepted ASPA bytes for VCIR failed: {e}"))?,

35
src/validation/tree_runner/tests.rs
View File

@@ -755,22 +755,21 @@ fn build_vcir_local_outputs_prefers_cached_outputs() {
},
rule_hash: sha256_32(b"cached-rule"),
}];
let outputs = build_vcir_local_outputs(
&ca,
&pack,
&crate::validation::objects::ObjectsOutput {
vrps: Vec::new(),
aspas: Vec::new(),
router_keys: Vec::new(),
local_outputs_cache: cached.clone(),
warnings: Vec::new(),
stats: crate::validation::objects::ObjectsStats::default(),
audit: Vec::new(),
roa_cache_stats: crate::validation::objects::RoaValidationCacheStats::default(),
},
)
.expect("reuse cached outputs");
let mut objects = crate::validation::objects::ObjectsOutput {
vrps: Vec::new(),
aspas: Vec::new(),
router_keys: Vec::new(),
local_outputs_cache: cached.clone(),
warnings: Vec::new(),
stats: crate::validation::objects::ObjectsStats::default(),
audit: Vec::new(),
roa_cache_stats: crate::validation::objects::RoaValidationCacheStats::default(),
roa_cache_object_meta: Vec::new(),
};
let outputs =
take_or_build_vcir_local_outputs(&ca, &pack, &mut objects).expect("reuse cached outputs");
assert_eq!(outputs, cached);
assert!(objects.local_outputs_cache.is_empty());
}
#[test]
@@ -1277,6 +1276,7 @@ fn build_vcir_related_artifacts_classifies_snapshot_files_and_audit_statuses() {
},
],
roa_cache_stats: crate::validation::objects::RoaValidationCacheStats::default(),
roa_cache_object_meta: Vec::new(),
};
let artifacts = build_vcir_related_artifacts(
&ca,
@@ -2778,6 +2778,7 @@ fn build_publication_point_audit_emits_no_audit_entry_for_duplicate_pack_uri() {
stats: crate::validation::objects::ObjectsStats::default(),
audit: Vec::new(),
roa_cache_stats: crate::validation::objects::RoaValidationCacheStats::default(),
roa_cache_object_meta: Vec::new(),
};
let audit = build_publication_point_audit_from_snapshot(
@@ -2847,6 +2848,7 @@ fn build_publication_point_audit_marks_invalid_crl_as_error_and_overlays_roa_aud
detail: None,
}],
roa_cache_stats: crate::validation::objects::RoaValidationCacheStats::default(),
roa_cache_object_meta: Vec::new(),
};
let audit = build_publication_point_audit_from_snapshot(
@@ -3895,6 +3897,7 @@ fn build_publication_point_audit_from_vcir_uses_vcir_metadata_and_overlays_child
detail: Some("overridden from object audit".to_string()),
}],
roa_cache_stats: crate::validation::objects::RoaValidationCacheStats::default(),
roa_cache_object_meta: Vec::new(),
};
let child_audits = vec![ObjectAuditEntry {
rsync_uri: vcir.child_entries[0].child_cert_rsync_uri.clone(),
@@ -3992,6 +3995,7 @@ fn build_publication_point_audit_from_vcir_failed_no_cache_keeps_current_reject_
detail: Some("manifest is not valid at validation_time".to_string()),
}],
roa_cache_stats: crate::validation::objects::RoaValidationCacheStats::default(),
roa_cache_object_meta: Vec::new(),
};
let audit = build_publication_point_audit_from_vcir(
@@ -4129,6 +4133,7 @@ fn build_publication_point_audit_from_vcir_without_cached_inputs_returns_empty_l
stats: crate::validation::objects::ObjectsStats::default(),
audit: Vec::new(),
roa_cache_stats: crate::validation::objects::RoaValidationCacheStats::default(),
roa_cache_object_meta: Vec::new(),
},
&[],
&[],