From e2bdcd3820118056217c99e01d94763450d2bc38 Mon Sep 17 00:00:00 2001 From: "xiuting.xu" Date: Thu, 9 Jul 2026 17:14:21 +0800 Subject: [PATCH] =?UTF-8?q?Server=E5=92=8Cclient=E9=83=A8=E7=BD=B2?= =?UTF-8?q?=E6=95=B4=E7=90=86?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- README.client.md | 230 +++++++++++++++ README.md | 61 +++- certs/{ => ssh}/_probe_key | 0 certs/{ => ssh}/_probe_key.pub | 0 certs/{ => ssh}/bird-rtr-client-rsa.pem | 0 certs/{ => ssh}/bird-rtr-client-rsa.pem.pub | Bin certs/{ => ssh}/bird-rtr-client.key | 0 certs/{ => ssh}/bird-rtr-client.key.pub | 0 certs/{ => ssh}/bird-rtr-client.pem | 0 certs/{ => ssh}/bird-rtr-client.pem.pub | Bin certs/{ => ssh}/rtr-authorized_keys | 0 certs/{ => ssh}/rtr-client.key | 0 certs/{ => ssh}/rtr-client.key.pub | 0 certs/{ => ssh}/rtr-client.pem | 0 certs/{ => ssh}/ssh_host_rsa_key | 0 certs/{ => ssh}/ssh_host_rsa_key.pub | 0 certs/{ => ssh}/ssh_known_hosts | 0 certs/{ => ssh}/testkey | 0 certs/{ => ssh}/testkey.pub | 0 certs/{ => ssh}/testkey3 | 0 certs/{ => ssh}/testkey3.pub | 0 certs/tls/client-ca.crt | 19 ++ certs/tls/client-good.crt | 20 ++ certs/tls/client-good.key | 28 ++ certs/tls/server-dns.crt | 19 ++ certs/tls/server-dns.key | 28 ++ deploy/README.md | 278 ------------------ deploy/bird/.env | 4 +- deploy/bird/README.md | 2 +- deploy/bird/README.zh.md | 2 +- deploy/bird/docker-compose.ssh.yml | 2 +- deploy/bird/docker-compose.yml | 2 +- deploy/client/.env | 12 +- deploy/client/docker-compose.clients.yml | 10 +- deploy/client/docker-compose.ssh.password.yml | 4 +- deploy/client/docker-compose.ssh.yml | 4 +- deploy/client/docker-compose.tcp.yml | 2 +- deploy/client/docker-compose.tls.yml | 4 +- deploy/client/docker-compose.yml | 2 +- deploy/frr/.env | 4 + deploy/frr/README.md | 24 +- deploy/frr/README.zh.md | 20 +- deploy/frr/docker-compose.yml | 10 +- deploy/frr/entrypoint.sh | 24 ++ deploy/frr/frr.conf.template | 22 ++ deploy/server/.env | 16 +- deploy/server/DEPLOYMENT.md | 2 +- deploy/server/docker-compose.ssh.yml | 5 +- deploy/server/docker-compose.tls.yml | 2 +- deploy/server/docker-compose.yml | 4 +- src/rtr/config.rs | 10 +- 51 files changed, 532 insertions(+), 344 deletions(-) create mode 100644 README.client.md rename certs/{ => ssh}/_probe_key (100%) rename certs/{ => ssh}/_probe_key.pub (100%) rename certs/{ => ssh}/bird-rtr-client-rsa.pem (100%) rename certs/{ => ssh}/bird-rtr-client-rsa.pem.pub (100%) rename certs/{ => ssh}/bird-rtr-client.key (100%) rename certs/{ => ssh}/bird-rtr-client.key.pub (100%) rename certs/{ => ssh}/bird-rtr-client.pem (100%) rename certs/{ => ssh}/bird-rtr-client.pem.pub (100%) rename certs/{ => ssh}/rtr-authorized_keys (100%) rename certs/{ => ssh}/rtr-client.key (100%) rename certs/{ => ssh}/rtr-client.key.pub (100%) rename certs/{ => ssh}/rtr-client.pem (100%) rename certs/{ => ssh}/ssh_host_rsa_key (100%) rename certs/{ => ssh}/ssh_host_rsa_key.pub (100%) rename certs/{ => ssh}/ssh_known_hosts (100%) rename certs/{ => ssh}/testkey (100%) rename certs/{ => ssh}/testkey.pub (100%) rename certs/{ => ssh}/testkey3 (100%) rename certs/{ => ssh}/testkey3.pub (100%) create mode 100644 certs/tls/client-ca.crt create mode 100644 certs/tls/client-good.crt create mode 100644 certs/tls/client-good.key create mode 100644 certs/tls/server-dns.crt create mode 100644 certs/tls/server-dns.key delete mode 100644 deploy/README.md create mode 100644 deploy/frr/.env create mode 100644 deploy/frr/entrypoint.sh create mode 100644 deploy/frr/frr.conf.template diff --git a/README.client.md b/README.client.md new file mode 100644 index 0000000..2abf00b --- /dev/null +++ b/README.client.md @@ -0,0 +1,230 @@ +# RTR Client 使用说明 + +本文说明仓库内三类 RTR Client 的用途、启动方式和验证命令： + +- `deploy/client`: 本仓库自带的 `rtr_debug_client`，适合做 RTR 协议调试、连通性检查和单次查询。 +- `deploy/frr`: FRR 作为黑盒 RTR Client，适合验证真实路由软件是否能消费 server 下发的 VRP。 +- `deploy/bird`: BIRD 作为黑盒 RTR Client，适合验证 TCP 或 SSH transport 下的 RPKI/ROA/ASPA 数据导入。 + +以下命令默认从仓库根目录执行。 + +## 目录 + +- [前置条件](#前置条件) +- [rtr_debug_client](#rtr_debug_client) + - [TCP](#tcp) + - [TLS/mTLS](#tlsmtls) + - [SSH](#ssh) + - [多客户端压测](#多客户端压测) +- [FRR Client](#frr-client) +- [BIRD Client](#bird-client) + - [TCP](#tcp-1) + - [SSH](#ssh-1) +- [如何判断 Client 正常](#如何判断-client-正常) + +## 前置条件 + +先启动 RTR Server。TCP 模式是最常用的本地验证方式： + +```bash +./deploy/server/build-run.sh up --mode tcp +``` + +如果要测试 TLS 或 SSH，需要先启动对应 server 模式，并准备匹配的证书或 SSH key： + +```bash +./deploy/server/build-run.sh up --mode tls +./deploy/server/build-run.sh up --mode ssh +``` + +Client 连接地址不要求固定在某个 Docker 网络里。`deploy/client` 的 TCP/TLS/SSH 模式分别通过 `RPKI_RTR_TCP_SERVER_ADDR`、`RPKI_RTR_TLS_SERVER_ADDR`、`RPKI_RTR_SSH_SERVER_ADDR` 指定 server 地址。`deploy/bird` 通过 `RPKI_BIRD_RPKI_HOST`/`RPKI_BIRD_RPKI_PORT` 指定 TCP server 地址，通过 `RPKI_BIRD_SSH_RPKI_HOST`/`RPKI_RTR_SSH_PORT` 指定 SSH server 地址。示例 compose 里的默认值只是为了和本仓库 server compose 直接联调。 + +`deploy/frr` 示例默认连接 `127.0.0.1:323`，可以通过 `RPKI_FRR_RPKI_HOST`/`RPKI_FRR_RPKI_PORT` 覆盖。 + +## rtr_debug_client + +`rtr_debug_client` 是本仓库提供的调试客户端。它会发起 RTR Reset Query 或 Serial Query，并打印 server 返回的 PDU 摘要。Docker 配置默认执行： + +```text + reset --keep-after-error --summary-only +``` + +### TCP + +```bash +./deploy/client/build-run.sh up --mode tcp +./deploy/client/build-run.sh logs --mode tcp +./deploy/client/build-run.sh down --mode tcp +``` + +默认连接 `rpki-rtr:323`，协议版本默认是 `2`。可以通过 `deploy/client/.env` 或环境变量覆盖： + +```bash +RPKI_RTR_TCP_SERVER_ADDR=10.0.0.12:323 \ +RPKI_RTR_PROTOCOL_VERSION=2 \ +./deploy/client/build-run.sh up --mode tcp +``` + +### TLS/mTLS + +```bash +./deploy/client/build-run.sh up --mode tls +./deploy/client/build-run.sh logs --mode tls +./deploy/client/build-run.sh down --mode tls +``` + +TLS 模式默认读取 `certs/tls` 下的示例证书，并使用 `localhost` 作为 server name。常用变量： + +| 变量 | 默认值 | 说明 | +| --- | --- | --- | +| `RPKI_RTR_TLS_SERVER_ADDR` | `rpki-rtr:324` | TLS RTR server 地址 | +| `RPKI_RTR_TLS_SERVER_NAME` | `localhost` | 必须匹配 server 证书 SAN dNSName | +| `RPKI_RTR_TLS_CA_CERT_PATH` | `/app/certs/client-ca.crt` | 容器内 CA 证书路径 | +| `RPKI_RTR_TLS_CLIENT_CERT_PATH` | `/app/certs/client-good.crt` | 容器内 client 证书路径 | +| `RPKI_RTR_TLS_CLIENT_KEY_PATH` | `/app/certs/client-good.key` | 容器内 client 私钥路径 | +| `RPKI_RTR_TLS_CERTS_HOST_DIR` | `../../certs/tls` | 宿主机 TLS 证书目录 | + +### SSH + +```bash +./deploy/client/build-run.sh up --mode ssh +./deploy/client/build-run.sh logs --mode ssh +./deploy/client/build-run.sh down --mode ssh +``` + +SSH 模式默认连接 `rpki-rtr-ssh:22`，使用 key 认证，并校验 server public key。常用变量： + +| 变量 | 默认值 | 说明 | +| --- | --- | --- | +| `RPKI_RTR_SSH_SERVER_ADDR` | `rpki-rtr:22` | SSH RTR server 地址 | +| `RPKI_RTR_SSH_USERNAME` | `rpki-rtr` | SSH 用户名 | +| `RPKI_RTR_CLIENT_KEYS_VOLUME` | `../../certs/ssh:/app/certs:ro` | 宿主机 SSH key 目录挂载 | +| `RPKI_RTR_CLIENT_KEY_PATH` | `/app/certs/rtr-client.key` | 容器内 client 私钥 | +| `RPKI_RTR_SSH_SERVER_PUBKEY_PATH` | `/app/certs/ssh_host_rsa_key.pub` | 容器内 server public key | + +### 多客户端压测 + +`--clients multi` 会启动 5 个 TCP debug client，用于观察并发连接、client report 和 server 连接统计。 + +```bash +./deploy/client/build-run.sh up --mode tcp --clients multi +./deploy/client/build-run.sh logs --mode tcp --clients multi +./deploy/client/build-run.sh down --mode tcp --clients multi +``` + +## FRR Client + +FRR 示例用于验证标准路由软件能否通过 RTR over TCP 从 server 获取前缀验证数据。 + +启动： + +```bash +docker compose --env-file deploy/frr/.env -f deploy/frr/docker-compose.yml up -d +``` + +默认连接 `127.0.0.1:323`。可以通过环境变量覆盖： + +```bash +RPKI_FRR_RPKI_HOST=10.0.0.12 \ +RPKI_FRR_RPKI_PORT=323 \ +docker compose --env-file deploy/frr/.env -f deploy/frr/docker-compose.yml up -d +``` + +验证连接和数据： + +```bash +docker exec -it frr-rpki-client vtysh -c "show rpki configuration" +docker exec -it frr-rpki-client vtysh -c "show rpki cache-connection" +docker exec -it frr-rpki-client vtysh -c "show rpki prefix-table" +``` + +停止： + +```bash +docker compose --env-file deploy/frr/.env -f deploy/frr/docker-compose.yml down +``` + +FRR 容器启动时会读取 `deploy/frr/frr.conf.template`，并生成 `/etc/frr/frr.conf`。模板中的 RTR cache 配置为： + +```text +rpki cache tcp ${RPKI_FRR_RPKI_HOST} ${RPKI_FRR_RPKI_PORT} preference ${RPKI_FRR_RPKI_PREFERENCE} +``` + +如果需要调整 polling、timeout、BGP router-id 等其他 FRR 配置，可以修改 `deploy/frr/frr.conf.template`，或在 compose 中挂载自己的模板和 entrypoint。 + +## BIRD Client + +BIRD 示例用于验证 BIRD 3.x 对 RTR v2、ROA 和 ASPA 的导入情况。容器启动后会周期性输出 RPKI 协议状态和表项摘要。 + +### TCP + +启动： + +```bash +docker compose --env-file deploy/bird/.env -f deploy/bird/docker-compose.yml up -d --build +``` + +查看日志： + +```bash +docker logs -f bird-rpki-client +``` + +停止： + +```bash +docker compose --env-file deploy/bird/.env -f deploy/bird/docker-compose.yml down +``` + +默认连接 `rpki-rtr:323`。可以通过环境变量覆盖： + +```bash +RPKI_BIRD_RPKI_HOST=10.0.0.12 \ +RPKI_BIRD_RPKI_PORT=323 \ +docker compose --env-file deploy/bird/.env -f deploy/bird/docker-compose.yml up -d --build +``` + +### SSH + +先启动 server SSH 模式： + +```bash +./deploy/server/build-run.sh up --mode ssh +``` + +再启动 BIRD SSH client： + +```bash +docker compose --env-file deploy/bird/.env \ + -f deploy/bird/docker-compose.yml \ + -f deploy/bird/docker-compose.ssh.yml \ + up -d --build +``` + +查看日志： + +```bash +docker logs -f bird-rpki-client +``` + +SSH 模式默认读取 `certs/ssh` 目录下的 key，并使用 `bird.conf.ssh.template` 生成运行时配置。关键默认值： + +| 变量 | 默认值 | 说明 | +| --- | --- | --- | +| `RPKI_BIRD_SSH_RPKI_HOST` | `rpki-rtr` | SSH RTR server 主机名 | +| `RPKI_RTR_SSH_PORT` | `22` | SSH RTR server 端口 | +| `RPKI_BIRD_SSH_CERTS_HOST_DIR` | `../../certs/ssh` | 宿主机 SSH 证书和 key 目录 | + +## 如何判断 Client 正常 + +- `rtr_debug_client`: 日志中能看到 Reset Query 成功、EndOfData 和 payload 统计。 +- FRR: `show rpki cache-connection` 显示已连接，`show rpki prefix-table` 有 VRP 条目。 +- BIRD: 日志中 RPKI protocol 状态为 `up`，ROA/ASPA 表项摘要不为空。 + +如果 client 无法连接，优先检查： + +- server 是否按对应 transport 启动。 +- client 配置的 server 地址是否从当前容器或主机可达。 +- TLS 的 server name 是否匹配证书 SAN。 +- SSH 的用户名、client key 和 server public key 是否匹配。 +- `RPKI_RTR_PROTOCOL_VERSION` 或 BIRD 配置中的 `min version`/`max version` 是否和 server 能力一致。 diff --git a/README.md b/README.md index 8d719a2..b0e457a 100644 --- a/README.md +++ b/README.md @@ -12,6 +12,23 @@ - 运行期管理：可选启用 HTTP Admin API，修改部分 runtime config、触发 source reload、管理 SLURM 文件。 - 调试工具：`rtr_debug_client` 支持 TCP、TLS 和 SSH 连接 RTR server。 +## 目录 + +- [协议参考](#协议参考) +- [项目结构](#项目结构) +- [构建与测试](#构建与测试) +- [数据输入](#数据输入) +- [快速启动](#快速启动) + - [Docker 运行](#docker-运行) + - [跨架构构建](#跨架构构建) +- [传输模式](#传输模式) +- [主要环境变量](#主要环境变量) +- [运行报告](#运行报告) +- [Admin API](#admin-api) +- [调试客户端](#调试客户端) +- [部署入口](#部署入口) +- [开发说明](#开发说明) + ## 协议参考 - RTR: [RFC 6810](https://www.rfc-editor.org/rfc/rfc6810.html), [RFC 8210](https://www.rfc-editor.org/rfc/rfc8210.html) @@ -73,7 +90,25 @@ chmod +x deploy/server/build-run.sh deploy/client/build-run.sh ./deploy/server/build-run.sh down ``` -更多 action、mode 和环境变量说明见 `deploy/README.md`。 +脚本常用参数： + +| 参数/变量 | server | client | 说明 | +| --- | --- | --- | --- | +| `--mode base|tcp|tls|ssh`, `MODE` | yes | yes | 选择 compose 模式，默认 `tcp`。 | +| `--clients single|multi`, `CLIENTS` | no | yes | 单 client 或 5 client，默认 `single`。 | +| `--no-build`, `BUILD=0` | yes | yes | 只运行已有镜像，不执行 compose build。 | +| `--server-image TAG`, `SERVER_IMAGE` | yes | no | server 镜像名；会传给 compose 的 `RPKI_RTR_SERVER_IMAGE`。 | +| `--client-image TAG`, `CLIENT_IMAGE` | no | yes | client 镜像名；会传给 compose 的 `RPKI_RTR_CLIENT_IMAGE`。 | +| `--platform VALUE`, `TARGET_PLATFORM` | yes | yes | `buildx` 目标平台，默认 `linux/arm64`。 | +| `--push`, `BUILDX_PUSH=1` | yes | yes | `buildx` 构建后推送到 registry；不设置时加载到本地 Docker。 | +| `--skip-base-pull`, `SKIP_BASE_IMAGE_PULL=1` | yes | yes | 跳过 buildx 前的基础镜像预拉取。 | + +支持的 action 包括 `up`、`build`、`buildx`、`rebuild`、`down`/`stop`、`restart`、`logs`、`ps`。完整帮助见： + +```bash +./deploy/server/build-run.sh --help +./deploy/client/build-run.sh --help +``` ### 跨架构构建 示例：x86 开发机本地构建 ARM 镜像，打包后传到 ARM 部署机。 @@ -171,16 +206,16 @@ TLS 相关路径： | 变量 | 默认值 | | --- | --- | -| `RPKI_RTR_TLS_CERT_PATH` | `./certs/server.crt` | -| `RPKI_RTR_TLS_KEY_PATH` | `./certs/server.key` | -| `RPKI_RTR_TLS_CLIENT_CA_PATH` | `./certs/client-ca.crt` | +| `RPKI_RTR_TLS_CERT_PATH` | `./certs/tls/server-dns.crt` | +| `RPKI_RTR_TLS_KEY_PATH` | `./certs/tls/server-dns.key` | +| `RPKI_RTR_TLS_CLIENT_CA_PATH` | `./certs/tls/client-ca.crt` | SSH 相关配置： | 变量 | 默认值 | | --- | --- | -| `RPKI_RTR_SSH_HOST_KEY_PATH` | `./certs/ssh_host_ed25519_key` | -| `RPKI_RTR_SSH_AUTHORIZED_KEYS_PATH` | `./certs/rtr-authorized_keys` | +| `RPKI_RTR_SSH_HOST_KEY_PATH` | `./certs/ssh/ssh_host_rsa_key` | +| `RPKI_RTR_SSH_AUTHORIZED_KEYS_PATH` | `./certs/ssh/rtr-authorized_keys` | | `RPKI_RTR_SSH_USERNAME` | `rpki-rtr` | | `RPKI_RTR_SSH_SUBSYSTEM_NAME` | `rpki-rtr` | | `RPKI_RTR_SSH_AUTH_MODE` | `key` | @@ -242,6 +277,8 @@ curl -X POST http://127.0.0.1:8323/admin/rtr/config \ `rtr_debug_client` 用于手动发起 Reset Query 或 Serial Query，并观察服务端返回的 PDU。 +RTR Client 的 Docker 调试、FRR/BIRD 互通验证和常用排障步骤见 `README.client.md`。 + TCP： ```bash @@ -255,10 +292,10 @@ TLS： cargo run --bin rtr_debug_client -- \ 127.0.0.1:324 1 reset \ --tls \ - --ca-cert tests/fixtures/tls/client-ca.crt \ + --ca-cert certs/tls/client-ca.crt \ --server-name localhost \ - --client-cert tests/fixtures/tls/client-good.crt \ - --client-key tests/fixtures/tls/client-good.key + --client-cert certs/tls/client-good.crt \ + --client-key certs/tls/client-good.key ``` SSH： @@ -268,8 +305,8 @@ cargo run --bin rtr_debug_client -- \ 127.0.0.1:22 1 reset \ --ssh \ --ssh-user rpki-rtr \ - --ssh-key certs/rtr-client.key \ - --ssh-server-key certs/ssh_host_rsa_key.pub + --ssh-key certs/ssh/rtr-client.key \ + --ssh-server-key certs/ssh/ssh_host_rsa_key.pub ``` SSH password auth 也已实现；SSH 模式下 `--ssh-key` 和 `--ssh-password` 二选一，同时必须通过 `--ssh-known-hosts` 或 `--ssh-server-key` 做 host key 校验。 @@ -289,6 +326,8 @@ SSH password auth 也已实现；SSH 模式下 `--ssh-key` 和 `--ssh-password` | FRR client | `deploy/frr/docker-compose.yml` | | BIRD client | `deploy/bird/docker-compose.yml` | +RTR Client 统一使用说明见 `README.client.md`。 + 通用操作： ```bash diff --git a/certs/_probe_key b/certs/ssh/_probe_key similarity index 100% rename from certs/_probe_key rename to certs/ssh/_probe_key diff --git a/certs/_probe_key.pub b/certs/ssh/_probe_key.pub similarity index 100% rename from certs/_probe_key.pub rename to certs/ssh/_probe_key.pub diff --git a/certs/bird-rtr-client-rsa.pem b/certs/ssh/bird-rtr-client-rsa.pem similarity index 100% rename from certs/bird-rtr-client-rsa.pem rename to certs/ssh/bird-rtr-client-rsa.pem diff --git a/certs/bird-rtr-client-rsa.pem.pub b/certs/ssh/bird-rtr-client-rsa.pem.pub similarity index 100% rename from certs/bird-rtr-client-rsa.pem.pub rename to certs/ssh/bird-rtr-client-rsa.pem.pub diff --git a/certs/bird-rtr-client.key b/certs/ssh/bird-rtr-client.key similarity index 100% rename from certs/bird-rtr-client.key rename to certs/ssh/bird-rtr-client.key diff --git a/certs/bird-rtr-client.key.pub b/certs/ssh/bird-rtr-client.key.pub similarity index 100% rename from certs/bird-rtr-client.key.pub rename to certs/ssh/bird-rtr-client.key.pub diff --git a/certs/bird-rtr-client.pem b/certs/ssh/bird-rtr-client.pem similarity index 100% rename from certs/bird-rtr-client.pem rename to certs/ssh/bird-rtr-client.pem diff --git a/certs/bird-rtr-client.pem.pub b/certs/ssh/bird-rtr-client.pem.pub similarity index 100% rename from certs/bird-rtr-client.pem.pub rename to certs/ssh/bird-rtr-client.pem.pub diff --git a/certs/rtr-authorized_keys b/certs/ssh/rtr-authorized_keys similarity index 100% rename from certs/rtr-authorized_keys rename to certs/ssh/rtr-authorized_keys diff --git a/certs/rtr-client.key b/certs/ssh/rtr-client.key similarity index 100% rename from certs/rtr-client.key rename to certs/ssh/rtr-client.key diff --git a/certs/rtr-client.key.pub b/certs/ssh/rtr-client.key.pub similarity index 100% rename from certs/rtr-client.key.pub rename to certs/ssh/rtr-client.key.pub diff --git a/certs/rtr-client.pem b/certs/ssh/rtr-client.pem similarity index 100% rename from certs/rtr-client.pem rename to certs/ssh/rtr-client.pem diff --git a/certs/ssh_host_rsa_key b/certs/ssh/ssh_host_rsa_key similarity index 100% rename from certs/ssh_host_rsa_key rename to certs/ssh/ssh_host_rsa_key diff --git a/certs/ssh_host_rsa_key.pub b/certs/ssh/ssh_host_rsa_key.pub similarity index 100% rename from certs/ssh_host_rsa_key.pub rename to certs/ssh/ssh_host_rsa_key.pub diff --git a/certs/ssh_known_hosts b/certs/ssh/ssh_known_hosts similarity index 100% rename from certs/ssh_known_hosts rename to certs/ssh/ssh_known_hosts diff --git a/certs/testkey b/certs/ssh/testkey similarity index 100% rename from certs/testkey rename to certs/ssh/testkey diff --git a/certs/testkey.pub b/certs/ssh/testkey.pub similarity index 100% rename from certs/testkey.pub rename to certs/ssh/testkey.pub diff --git a/certs/testkey3 b/certs/ssh/testkey3 similarity index 100% rename from certs/testkey3 rename to certs/ssh/testkey3 diff --git a/certs/testkey3.pub b/certs/ssh/testkey3.pub similarity index 100% rename from certs/testkey3.pub rename to certs/ssh/testkey3.pub diff --git a/certs/tls/client-ca.crt b/certs/tls/client-ca.crt new file mode 100644 index 0000000..5094787 --- /dev/null +++ b/certs/tls/client-ca.crt @@ -0,0 +1,19 @@ +-----BEGIN CERTIFICATE----- +MIIDGzCCAgOgAwIBAgIUKCaM+eEU12YVn/tC6MEBYPj50oIwDQYJKoZIhvcNAQEL +BQAwHTEbMBkGA1UEAwwSUlRSIFRlc3QgQ2xpZW50IENBMB4XDTI2MDMyMzA4MDQy +OFoXDTM2MDMyMDA4MDQyOFowHTEbMBkGA1UEAwwSUlRSIFRlc3QgQ2xpZW50IENB +MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmmS+gsRZXPaG20Ra2te7 +WVeqyeFX2lV/RvNsT3WW+EtwuTN2aFJ/pBgSCqgCaFocU5IcgfScybQrjmTWeEot +D0F1OOW/TihlBsrU3BS8vOZ4KTuwB9eOgpt7FL8CxLetjNWxZKBsvJMauOUYFLCt +DN+78EDqrZ2VyJPfa+7dJKS/JoRgs/WFjvAeb5x1UpKPf/gp1Ji+Vj92Ux9znYF1 +2Zfs77NsLdwcqyMVj7cb1nucutNf/vMqNi+BoSwC/tQkflda9bLUwto/ZfFPsCFw +Ptjwiwm+IGNAKG8r1ujaUVDtxc+NliuAbHERBgZGtYpAE6u28+d8cUAyGGQFNGqb +uQIDAQABo1MwUTAdBgNVHQ4EFgQUtiTCqdhd2TwFc7JZGWkF8BEcMJwwHwYDVR0j +BBgwFoAUtiTCqdhd2TwFc7JZGWkF8BEcMJwwDwYDVR0TAQH/BAUwAwEB/zANBgkq +hkiG9w0BAQsFAAOCAQEATr0wChmDvmw51RQ0kOFP1l3n+O1n/U0xR39YApnmdhtk +MyO9gNyqxdUWj4QaRkswr5iMyjsLrT3lYWGfh7oHlhIgkXEy5OK548rhj/PA6d5U +M7DDGI06EFfYXcC57Cx1y8Egd9gfkfPk0ned/TG+/dYtyb7sBiIKrOiDExbfZ53U +mNtfsdptBoOjee4KggplfVhkUopyO0KKD7twq4dvWgzWZHv7m5wrQA8GP8W4JpPP +ZAs8cOLfq4cxAwYFXEaf0x7is2u9KdagPqXkiPMeC8fOHWyRCR7sKN4Dnh57ruqq +mQXil9GGFfkDA/bh6+Rs93Yll7yYyA3xif6fSBmgUg== +-----END CERTIFICATE----- diff --git a/certs/tls/client-good.crt b/certs/tls/client-good.crt new file mode 100644 index 0000000..9f4e2ff --- /dev/null +++ b/certs/tls/client-good.crt @@ -0,0 +1,20 @@ +-----BEGIN CERTIFICATE----- +MIIDMjCCAhqgAwIBAgIUTLfIortKKjsYovPDuDVnUR8i2YMwDQYJKoZIhvcNAQEL +BQAwHTEbMBkGA1UEAwwSUlRSIFRlc3QgQ2xpZW50IENBMB4XDTI2MDMyMzA4MDUw +MFoXDTM2MDMyMDA4MDUwMFowHzEdMBsGA1UEAwwUUlRSIFRlc3QgQ2xpZW50IEdv +b2QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDUjnhxQxKUNLjGN6mu +/VvoGXfsyvZq38QMlfIauGPQ5Jwpq2BU2gW1zFvjBJaS8ZKY2DOsBKvZMrEiSxVt +8WCCgvSucw5Elwniq/Yu8UmkvWEMnk9oXwQuHQeWYSe2eMvwBMTNaj3Vz+xo2Ga/ ++eGClxPDcKKvOMYz+BRpyMfHzX1LLrM26yDjyxQKxzsrFMQ5IKXkhv4COLAjpLZd +oEDSkG+W4fbGTC6bSkskFP62OmnR/Qq6dXBVAJkzHqoiWEmKWBQy9JhEo+N3Jz7D +QfOAI/20MD6J4brWS56ciHL67yQjHJW6P0HlcLzefFqspIwvTFyCsF137jJi9sqL +y7UlAgMBAAGjaDBmMA8GA1UdEQQIMAaHBH8AAAEwEwYDVR0lBAwwCgYIKwYBBQUH +AwIwHQYDVR0OBBYEFJy0O+AR5EdWrUr2UHtPCUVTrRiEMB8GA1UdIwQYMBaAFLYk +wqnYXdk8BXOyWRlpBfARHDCcMA0GCSqGSIb3DQEBCwUAA4IBAQB8eavz/Pk3oJBh +sgy4ve6nLAqKGcD+zSoBxw/ErZaDNdUZZaFKT9nypfi39jkfjU+CIfhczCs5Cknk +EDqYtp1BXkY+auKeYRkoaCKv+ucnIc6JZ70NOQGdDNzU4eb9tVA9Py0j5VzvxWR1 +yl6vHTc3tTA873RRezvUe+SQDwR+x2dxZ0O0MFZR4CTaTeR+fpD4bE9mBcYN1KVk +HdA7USCwOZ0qE+aHTegM4pgGrpHYS5yBpUFADqfJl1yBnnqc10zkphoy6dRsbVuN +NkDostGbbfGdGjEPs6i1TMsDTVyOo4nsHACk4q4m/IEVBkiMwxmwyhK1EEWQmQpy +h0CqAs3Z +-----END CERTIFICATE----- diff --git a/certs/tls/client-good.key b/certs/tls/client-good.key new file mode 100644 index 0000000..07bada9 --- /dev/null +++ b/certs/tls/client-good.key @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDUjnhxQxKUNLjG +N6mu/VvoGXfsyvZq38QMlfIauGPQ5Jwpq2BU2gW1zFvjBJaS8ZKY2DOsBKvZMrEi +SxVt8WCCgvSucw5Elwniq/Yu8UmkvWEMnk9oXwQuHQeWYSe2eMvwBMTNaj3Vz+xo +2Ga/+eGClxPDcKKvOMYz+BRpyMfHzX1LLrM26yDjyxQKxzsrFMQ5IKXkhv4COLAj +pLZdoEDSkG+W4fbGTC6bSkskFP62OmnR/Qq6dXBVAJkzHqoiWEmKWBQy9JhEo+N3 +Jz7DQfOAI/20MD6J4brWS56ciHL67yQjHJW6P0HlcLzefFqspIwvTFyCsF137jJi +9sqLy7UlAgMBAAECggEALmsOkm17WTJKR79QJw7dS0qEjgmk1qIXRkhYns01vyCt +mcv7NYyHQrRmPKV73Is04HwWjLJYdQ5E8KBFBcV4tgezN4WY0BHL7txu3sGCu58/ +2mmYHcriNs/QIF8HNSocH0ZrVBCngFHv5tWbWsFPJh2oCz5FyM41OpQqoQ9f0ZoA +PKq3m7dNidFmlQPhhJ9KeLYwDfzTRy4sWBDrgZFDQ6ut9nO8/JpJvxZCSnOdbW1T +6pYk3uAKKcmrcdI2fsg7u0J1zkrkDnRdrDv1QCY/h1UXvR4KuMeYRylHWJpOKUiR +asxpJO+lh7TmDaEIqO+dSmTHawcKDYuIp0EV4/x7AQKBgQD/cgMhx97bJ3ym0ucc +xtt10jo0NTW7SJIXx/eUdBQNA3aGWfsqLrBI5qKrXLxTXF/vAs3LWHiHF6EgRxW/ +7RbO+NZzAGxg53Y3PMqZ4AQbOm2JCIgT9ZhQc55+qowdtrts3njL+ayy3vWh3nPt +G78+rs4ZLCHhEutbkKqU7S3XSQKBgQDVBJ5l9d1QcqFqYnlmyhgfwJwpxo4N2dJR +18pCow8Mp8S9ROJx3OF4yNTRa6ipnX0oGdgchT63jXBDoKot3/4tqbjYj/Y3MmKL +crZ7dZEiAqkqE975qUfSlQS6BtknRKduzQzAJAKz0A+JbPIisPHIrBnG2PH9h2XA +TjA2rHRi/QKBgDIp65+IpqUW/g2swSIPky1yGWgDQwgCWl49MMuAeCeOFIqRxRcl +kAzg7fUFAx7Dtzsyq8NRHmo5I7U5AHZuUtpWV5bB8IafLcHvOEI7kdLfCH+uozp4 +Mm8qJWfuihGTvv7EOaik4VtHGamuC8n2dvoSTfr3hbezhXC32ifg4+2xAoGATbjp +snoKzheFHbPgZ8jFFJDKadOwcQ1Q19vMSJQGIa/08Ln5hWH6Qn/EZsTJPVnhGIiV +eZKEV6SbmZE9ho97xl1uvFWKmIkhu4+XVWSIF8iwwFGPwbgqJIOKvfVRtioujRbz +2AdLlSANCy9dCZtWHMnufccaRE7qqUfd/5TcwmECgYA5md1JZ+p+0yTkjNf4McCe +mpZiXXaM8uC3/XiWlfcw3ag88H0XCqt2UPcX03MC9ZzywfTdoEHhPRfr48uRiH7K +Pi1T8E2E0GkSfk6zh6wJm8Kmm9+VJd2rUFrb35xDMUfjpS228oH9UBQtwaAV+jmy +q/APoG+aWt5YIeYElx9mzA== +-----END PRIVATE KEY----- diff --git a/certs/tls/server-dns.crt b/certs/tls/server-dns.crt new file mode 100644 index 0000000..4f8be31 --- /dev/null +++ b/certs/tls/server-dns.crt @@ -0,0 +1,19 @@ +-----BEGIN CERTIFICATE----- +MIIDLDCCAhSgAwIBAgIUU9TJAAXI1pavsowFKFye0t8gdz4wDQYJKoZIhvcNAQEL +BQAwHTEbMBkGA1UEAwwSUlRSIFRlc3QgQ2xpZW50IENBMB4XDTI2MDMyNDAyMzA0 +N1oXDTM2MDMyMTAyMzA0N1owFDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkq +hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzXLZ2ZeySuuzCDEPXsHMym0py7Tuwizu +5a4AKQt+7d8b51x22W+I6ZQXYOCUml+C0PGs5TfQDXs0VbYj08flVxw9732FPqzp +PhkZJlEbnu7+nEW4mb+aM+pnPnW7iLeCvePGXicYO9YctQNA9Onxe+63QtEi2OtO +24wlqreToA2qQ7UOeNbpcY5p9psgXt9wW+8rq1gXmKsci8DV//1MessDTTX4tgIh +lOvKBIqx2E2kIIbZ6BwB7veKCkwqrFeVKzmwCXfkVQZkyfxKTBOvf3VFssnFJ7Ld +dYuAMTpl9jCHkNykGNlc0a9ohglEvAjqwgpUdMcuzMMR8Kf0DjqZqwIDAQABo20w +azAUBgNVHREEDTALgglsb2NhbGhvc3QwEwYDVR0lBAwwCgYIKwYBBQUHAwEwHQYD +VR0OBBYEFOYSmMCX8XUYA9jMGY2M1v5/xaimMB8GA1UdIwQYMBaAFLYkwqnYXdk8 +BXOyWRlpBfARHDCcMA0GCSqGSIb3DQEBCwUAA4IBAQArYXsdMl+vPyTyv/oRzCo0 +mWyVO3RZPPRJSrrMz4UjtVMIfq6pnV+AXPEcWL/zEfQNcRPjsJeezkG66AZbI+ug +fur90YVDhWfOgde4E3cVhZz90aM/jcRMVvwNj0XiaX4JpxsVhv5T4LC80aXm0r02 +YfJyqwtNaZlKDntaW56q7nD5eaoqmYa+ogpdqwCIfGvManfRH6v6xmzgQRKnD1lc +LZPDZ9dmkQg2N/vdZfVUpB2+EZYF/9BuIvJyGKNYBjJiQGv2kbaFUl13mw7D/yGP +Zytpu5AIPl6ScYog8x6dSJMiYM+hO1bD9qOU0Kq48PaLQoQ4poYo7zdbiB8TZaKC +-----END CERTIFICATE----- diff --git a/certs/tls/server-dns.key b/certs/tls/server-dns.key new file mode 100644 index 0000000..09247a4 --- /dev/null +++ b/certs/tls/server-dns.key @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDNctnZl7JK67MI +MQ9ewczKbSnLtO7CLO7lrgApC37t3xvnXHbZb4jplBdg4JSaX4LQ8azlN9ANezRV +tiPTx+VXHD3vfYU+rOk+GRkmURue7v6cRbiZv5oz6mc+dbuIt4K948ZeJxg71hy1 +A0D06fF77rdC0SLY607bjCWqt5OgDapDtQ541ulxjmn2myBe33Bb7yurWBeYqxyL +wNX//Ux6ywNNNfi2AiGU68oEirHYTaQghtnoHAHu94oKTCqsV5UrObAJd+RVBmTJ +/EpME69/dUWyycUnst11i4AxOmX2MIeQ3KQY2VzRr2iGCUS8COrCClR0xy7MwxHw +p/QOOpmrAgMBAAECggEAKOWyBCS0c0GUNA9AFgbSM4Gjjk+IL9MuAz6t/X2yWLvP +HDFF32bahFTcioZqToiwy9MwLbj8i5J5Co7lduUV/E887Q25lo5pJ9lrLjt7GhpN +SOKAKur/UVJaFw7ss/yD5DURafCyXEb1E/t/1ME1NwyAIqbrHu9IlV/Cp8c/dd6n +BUZHKN38Fs8riUOTW4BwAA1dV0k+g8bKb0byR5WmXbXqWG/XjfUKcI4Dg9ILsTwG +QgI/nzRyAV2unVcdNhM4pMTJ4U4x1Dh/rsWyQ4b206namkpfaIH7j8ovRY2OHhzT +EuCbn1Cpfmxp68hRrvMIhLvqVkXOSWzKOkHZba/qYQKBgQD0m3WJu5UHXip14gY/ +SmDm3vEcFjVZa+BmQtojs32ZfT/b1H5U+mfhXlVi0yf7B7nitQ9zOA7A2C8cxdtr +X9zd81MHLc7yUEOAlHBqSfBX/DyF1iRsdM7GYYxrsaECM7NIDukDR1Q/DvMZodRx +iVpRkNP3s87a1/QwvDKrwOPcCQKBgQDXBH1IZWcl1mrGgfAI7r5wXIJo0IrTlUcT +4nFSNv5YnrhnRzmLDRqxwlUs4II87nzsqv7OYryAg4n8us+X6XQv0hvTKcHsM7tl +vAO2EeQIER71tEg45HhmAXo2X2bE5kNMTr4COlb8k6R6r5K2F4yVMZim4qPcMYAK +tNRXf9JdEwKBgQDEjpOxvPmxdPrbxWfNvgAGJYpMTpBKLgShSAEwhRBdoacKCEQI +FzwYfoxQoGtVLk0yHtqudJJuZondLiT2sI60D85dS3MrhlHn5eA7mPS4Tyl3Rq/4 +Mxjhkwuakp9WPKNJOSoHB29sSKASrdcf8QaR2rZqKqQDeVtxOhnhqFuxuQKBgHrk +8/53BteXj/vZtKpGWs658UebOl3oinGREZgeGo3oWhmdmgQh/0nueuRlhcrxvLFA +otavlHIXvLyYwaJgKqpSetjcmxw4DTn+llhwLVd3Aa0J1+W8oBwdaA6/xGtx+LEa +qHt5gNJoSLBevYoaN53mdQudqm5mVHrKFDvWsRPFAoGBALAkJiXM4y+aTcwREjnO +CgebDRru37mprDW2PDa4vpTydxIcXZukTEZqXbVnXNDY/Gkyv06jYoY2R7mzbgfl +7RJIFAQffkzoeFadQZqimIAN3sQ6RRzNqmAlS2D6zjylX7N2rDiPcS3LtrJZHEyk +gTFx7+6gjfPNqPiAB5su0IJm +-----END PRIVATE KEY----- diff --git a/deploy/README.md b/deploy/README.md deleted file mode 100644 index 8582e4d..0000000 --- a/deploy/README.md +++ /dev/null @@ -1,278 +0,0 @@ -# Deploy Layout - -`deploy/` 目录按角色拆分为四套部署与测试入口： - -- `server/`: 本仓库 RTR Server（`src/main.rs`）容器化部署 -- `client/`: 本仓库 `rtr_debug_client` 容器化部署 -- `frr/`: FRR 作为黑盒 RTR Client 的配置与 compose - ---- - -## 0) Build and Run Scripts - -`deploy/server/build-run.sh` 只管理 server，`deploy/client/build-run.sh` 只管理 debug client。两个脚本默认 action 都是 `up`，默认 mode 都是 `tcp`。 - -常用命令： - -以下命令默认从仓库根目录执行。 - -```bash -chmod +x deploy/server/build-run.sh deploy/client/build-run.sh -./deploy/server/build-run.sh up --mode tcp -./deploy/client/build-run.sh up --mode tcp -./deploy/client/build-run.sh up --clients multi -./deploy/client/build-run.sh down -./deploy/server/build-run.sh down -``` - -常用参数： - -| 参数/变量 | server | client | 说明 | -| --- | --- | --- | --- | -| `--mode base\|tcp\|tls\|ssh`, `MODE` | yes | yes | 选择 compose 模式，默认 `tcp`。 | -| `--clients single\|multi`, `CLIENTS` | no | yes | 单 client 或 5 client，默认 `single`。 | -| `--no-build`, `BUILD=0` | yes | yes | 只运行已有镜像，不执行 compose build。 | -| `--server-image TAG`, `SERVER_IMAGE` | yes | no | server 镜像名；会传给 compose 的 `RPKI_RTR_SERVER_IMAGE`。 | -| `--client-image TAG`, `CLIENT_IMAGE` | no | yes | client 镜像名；会传给 compose 的 `RPKI_RTR_CLIENT_IMAGE`。 | -| `--platform VALUE`, `TARGET_PLATFORM` | yes | yes | `buildx` 目标平台，默认 `linux/arm64`。 | -| `--push`, `BUILDX_PUSH=1` | yes | yes | `buildx` 构建后推送到 registry；不设置时加载到本地 Docker。 | -| `--skip-base-pull`, `SKIP_BASE_IMAGE_PULL=1` | yes | yes | 跳过 buildx 前的基础镜像预拉取。 | - -支持的 action 包括 `up`、`build`、`buildx`、`rebuild`、`down`/`stop`、`restart`、`logs`、`ps`。完整帮助见： - -```bash -./deploy/server/build-run.sh --help -./deploy/client/build-run.sh --help -``` - -### x86 Build, ARM Deploy - -x86 开发机上用 Docker Buildx 分别构建 ARM server/client 镜像。不加 `--push` 时，脚本会把单平台镜像加载到本地 Docker，随后可用 `docker save` 打包传到 ARM 机器。buildx 前会自动按目标平台预拉取 `rust:1.89-bookworm` 和 `debian:bookworm-slim`。 - -```bash -docker buildx create --use --name rpki-builder -docker buildx inspect --bootstrap - -./deploy/server/build-run.sh buildx \ - --platform linux/arm64 \ - --server-image rpki-rtr:arm64 - -./deploy/client/build-run.sh buildx \ - --platform linux/arm64 \ - --client-image rpki-rtr-debug-client:arm64 - -mkdir -p dist/images -docker save rpki-rtr:arm64 -o dist/images/rpki-rtr-arm64.tar -docker save rpki-rtr-debug-client:arm64 -o dist/images/rpki-rtr-debug-client-arm64.tar -``` - -把 tar 包传到 ARM 部署机： - -```bash -scp dist/images/*.tar user@arm-host:/tmp/ -``` - -ARM 部署机上加载镜像并运行，不再本地构建： - -```bash -docker load -i /tmp/rpki-rtr-arm64.tar -docker load -i /tmp/rpki-rtr-debug-client-arm64.tar - -SERVER_IMAGE=rpki-rtr:arm64 \ -BUILD=0 ./deploy/server/build-run.sh up --mode tcp - -CLIENT_IMAGE=rpki-rtr-debug-client:arm64 \ -BUILD=0 ./deploy/client/build-run.sh up --mode tcp -``` - -如果不使用脚本，也可以通过 compose 环境变量指定镜像： - -```bash -export RPKI_RTR_SERVER_IMAGE=rpki-rtr:arm64 -docker compose --env-file deploy/server/.env \ - -f deploy/server/docker-compose.tcp.yml up -d --no-build -``` - ---- - -## 1) Server - -路径： -- `deploy/server/Dockerfile` -- `deploy/server/docker-compose.yml` -- `deploy/server/DEPLOYMENT.md` - -单独 build 镜像： - -```bash -docker build -f deploy/server/Dockerfile -t rpki-rtr:latest . -``` - -启动： - -```bash -docker compose -f deploy/server/docker-compose.yml up -d --build -``` - -停止： - -```bash -docker compose -f deploy/server/docker-compose.yml down -``` - -日志： - -```bash -docker compose -f deploy/server/docker-compose.yml logs -f rpki-rtr -``` - -报告文件： - -- `report/rtr-source-*.json`：CCR/SLURM source、fingerprint、refresh 状态、数据质量、cache snapshot/delta 统计。 -- `report/rtr-clients-*.json`：client 连接数和连接方式统计，启动时和连接变化时写入。 -- `report/rtr-runtime-*.json`：进程 RSS、服务状态、当前生效 runtime configuration，启动时和周期性写入。 - -Admin config 接口默认关闭。需要运行中动态修改 `max_delta`、delta 裁剪策略、refresh/report interval、timezone 或 RTR timing 时，设置： - -```env -RPKI_RTR_ADMIN_ADDR=127.0.0.1:8323 -RPKI_RTR_ADMIN_TOKEN=change-me -``` - -调用示例： - -```bash -curl -X POST http://127.0.0.1:8323/admin/rtr/config \ - -H "Content-Type: application/json" \ - -H "Authorization: Bearer change-me" \ - -d '{"max_delta": 6, "prune_delta_by_snapshot_size": true}' -``` - -完整 API 说明见 `docs/rtr-admin-api.md`，更完整的 server 配置见 `deploy/server/DEPLOYMENT.md`。 - ---- - -## 2) Debug Client - -路径： -- `deploy/client/Dockerfile` -- `deploy/client/docker-compose.yml` -- `deploy/client/docker-compose.clients.yml` - -单独 build 镜像： - -```bash -docker build -f deploy/client/Dockerfile -t rpki-rtr-debug-client:latest . -``` - -单实例启动（交互调试）： - -```bash -docker compose -f deploy/client/docker-compose.yml up --build -``` - -单实例停止： - -```bash -docker compose -f deploy/client/docker-compose.yml down -``` - -单实例日志： - -```bash -docker compose -f deploy/client/docker-compose.yml logs -f rtr-debug-client -``` - -多实例启动（5 个并发 client）： - -```bash -docker compose -f deploy/client/docker-compose.clients.yml up -d -``` - -多实例停止： - -```bash -docker compose -f deploy/client/docker-compose.clients.yml down -``` - -多实例日志： - -```bash -docker compose -f deploy/client/docker-compose.clients.yml logs -f -``` - ---- - -## 3) FRR Client - -路径： -- `deploy/frr/docker-compose.yml` -- `deploy/frr/daemons.example` -- `deploy/frr/frr.conf.example` -- `deploy/frr/README.md` -- `deploy/frr/README.zh.md` - -启动： - -```bash -docker compose -f deploy/frr/docker-compose.yml up -d -``` - -检查连接： - -```bash -docker exec -it frr-rpki-client vtysh -c "show rpki cache-connection" -docker exec -it frr-rpki-client vtysh -c "show rpki prefix-table" -``` - -停止： - -```bash -docker compose -f deploy/frr/docker-compose.yml down -``` - -日志： - -```bash -docker compose -f deploy/frr/docker-compose.yml logs -f frr-rpki-client -``` - ---- - -## 4) BIRD Client - -路径: -- `deploy/bird/Dockerfile` -- `deploy/bird/docker-compose.yml` -- `deploy/bird/docker-compose.tls.yml` -- `deploy/bird/bird.conf.example` -- `deploy/bird/bird.conf.tls.example` -- `deploy/bird/README.md` -- `deploy/bird/README.zh.md` - -启动: -```bash -docker compose -f deploy/bird/docker-compose.yml up --build -``` - -观察活动: - -```bash -docker logs -f bird-rpki-client -``` - -停止: -```bash -docker compose -f deploy/bird/docker-compose.yml down -``` - -日志: -```bash -docker compose -f deploy/bird/docker-compose.yml logs -f bird-rpki-client -``` - -TLS/mTLS: -```bash -docker compose -f deploy/bird/docker-compose.yml -f deploy/bird/docker-compose.tls.yml up --build -docker logs -f bird-rpki-client -``` diff --git a/deploy/bird/.env b/deploy/bird/.env index ac60e9a..c3c8ff5 100644 --- a/deploy/bird/.env +++ b/deploy/bird/.env @@ -2,7 +2,7 @@ RPKI_BIRD_VERSION=3.2.1 # TCP mode target endpoint. -RPKI_BIRD_RPKI_HOST=rpki-rtr-tcp +RPKI_BIRD_RPKI_HOST=rpki-rtr RPKI_BIRD_RPKI_PORT=323 # SSH mode target endpoint. @@ -30,4 +30,4 @@ RPKI_BIRD_SHOW_ROA6=1 # Host volume mounts. RPKI_BIRD_LOG_HOST_DIR=../../logs/bird -RPKI_BIRD_SSH_CERTS_HOST_DIR=../../certs +RPKI_BIRD_SSH_CERTS_HOST_DIR=../../certs/ssh diff --git a/deploy/bird/README.md b/deploy/bird/README.md index 3db6ff6..761bf41 100644 --- a/deploy/bird/README.md +++ b/deploy/bird/README.md @@ -82,7 +82,7 @@ docker logs -f bird-rpki-client `OBSERVE_DEBOUNCE_SECS` (default `1`), `OBSERVE_INTERVAL` (seconds, used when `OBSERVE_MODE=interval`), and `OBSERVE_PROTO`. -- SSH mode mounts `../../certs` into `/config/ssh` and expects: +- SSH mode mounts `../../certs/ssh` into `/config/ssh` and expects: `bird-rtr-client.pem` and `ssh_host_rsa_key.pub`. - Entrypoint auto-generates `/run/bird/known_hosts` from `/config/ssh/ssh_host_rsa_key.pub` for BIRD SSH host-key verification. diff --git a/deploy/bird/README.zh.md b/deploy/bird/README.zh.md index 5d7cf8f..a012158 100644 --- a/deploy/bird/README.zh.md +++ b/deploy/bird/README.zh.md @@ -73,7 +73,7 @@ docker logs -f bird-rpki-client - 当前 compose 使用 `network_mode: host`，默认通过 `host.docker.internal` 访问 server。 - 观测频率由环境变量控制：`OBSERVE_INTERVAL`（秒，默认 `30`）和 `OBSERVE_PROTO`。 -- SSH 模式会将 `../../certs` 挂载到容器 `/config/ssh`，并使用： +- SSH 模式会将 `../../certs/ssh` 挂载到容器 `/config/ssh`，并使用： `bird-rtr-client.pem`、`ssh_host_rsa_key.pub`。 - 入口脚本会基于 `/config/ssh/ssh_host_rsa_key.pub` 自动生成 `/run/bird/known_hosts`，用于 BIRD 的 SSH 主机密钥校验。 diff --git a/deploy/bird/docker-compose.ssh.yml b/deploy/bird/docker-compose.ssh.yml index fc818be..a95b648 100644 --- a/deploy/bird/docker-compose.ssh.yml +++ b/deploy/bird/docker-compose.ssh.yml @@ -7,7 +7,7 @@ services: OBSERVE_PROTO: "rpki_ssh" volumes: - ./bird.conf.ssh.template:/config/bird.conf.ssh.template:ro - - ${RPKI_BIRD_SSH_CERTS_HOST_DIR:-../../certs}:/config/ssh:ro + - ${RPKI_BIRD_SSH_CERTS_HOST_DIR:-../../certs/ssh}:/config/ssh:ro networks: - rpki_net diff --git a/deploy/bird/docker-compose.yml b/deploy/bird/docker-compose.yml index 35a5d2c..9b850d5 100644 --- a/deploy/bird/docker-compose.yml +++ b/deploy/bird/docker-compose.yml @@ -10,7 +10,7 @@ services: environment: BIRD_CONFIG_TEMPLATE_PATH: "${RPKI_BIRD_CONFIG_TEMPLATE_PATH:-/config/bird.conf.template}" - RPKI_HOST: "${RPKI_BIRD_RPKI_HOST:-rpki-rtr-tcp}" + RPKI_HOST: "${RPKI_BIRD_RPKI_HOST:-rpki-rtr}" RPKI_PORT: "${RPKI_BIRD_RPKI_PORT:-323}" OBSERVE_PROTO: "${RPKI_BIRD_OBSERVE_PROTO:-rpki_tcp}" diff --git a/deploy/client/.env b/deploy/client/.env index 0833959..acaa354 100644 --- a/deploy/client/.env +++ b/deploy/client/.env @@ -1,8 +1,10 @@ -# Target RTR server address for client compose files +# Target RTR server addresses for client compose files # TCP example: 10.0.0.12:323 # TLS example: rpki.example.com:324 # SSH example: 10.0.0.12:22 -RPKI_RTR_SERVER_ADDR=rpki-rtr-tcp:323 +RPKI_RTR_TCP_SERVER_ADDR=rpki-rtr:323 +RPKI_RTR_TLS_SERVER_ADDR=rpki-rtr:324 +RPKI_RTR_SSH_SERVER_ADDR=rpki-rtr:22 # RTR protocol version used as client command second argument (supported: 0,1,2) RPKI_RTR_PROTOCOL_VERSION=2 @@ -13,14 +15,14 @@ RPKI_RTR_TLS_SERVER_NAME=localhost RPKI_RTR_TLS_CA_CERT_PATH=/app/certs/client-ca.crt RPKI_RTR_TLS_CLIENT_CERT_PATH=/app/certs/client-good.crt RPKI_RTR_TLS_CLIENT_KEY_PATH=/app/certs/client-good.key -RPKI_RTR_TLS_CERTS_HOST_DIR=../../tests/fixtures/tls +RPKI_RTR_TLS_CERTS_HOST_DIR=../../certs/tls # Shared client logs mount on host. RPKI_RTR_CLIENT_LOG_HOST_DIR=../../logs/client # SSH mode examples: -# RPKI_RTR_SERVER_ADDR=10.0.0.12:2222 -RPKI_RTR_CLIENT_KEYS_VOLUME=../../certs:/app/certs:ro +# RPKI_RTR_SSH_SERVER_ADDR=10.0.0.12:2222 +RPKI_RTR_CLIENT_KEYS_VOLUME=../../certs/ssh:/app/certs:ro RPKI_RTR_CLIENT_KEY_PATH=/app/certs/rtr-client.key RPKI_RTR_SSH_SERVER_PUBKEY_PATH=/app/certs/ssh_host_rsa_key.pub RPKI_RTR_SSH_USERNAME=rpki-rtr diff --git a/deploy/client/docker-compose.clients.yml b/deploy/client/docker-compose.clients.yml index b7aba96..11eb11e 100644 --- a/deploy/client/docker-compose.clients.yml +++ b/deploy/client/docker-compose.clients.yml @@ -3,7 +3,7 @@ version: "3.9" services: rtr-client-1: image: ${RPKI_RTR_CLIENT_IMAGE:-rpki-rtr-debug-client:latest} - command: ["${RPKI_RTR_SERVER_ADDR:-rpki-rtr-tcp:323}", "${RPKI_RTR_PROTOCOL_VERSION:-2}", "reset", "--keep-after-error", "--summary-only"] + command: ["${RPKI_RTR_TCP_SERVER_ADDR:-rpki-rtr:323}", "${RPKI_RTR_PROTOCOL_VERSION:-2}", "reset", "--keep-after-error", "--summary-only"] volumes: - ${RPKI_RTR_CLIENT_LOG_HOST_DIR:-../../logs/client}:/app/logs restart: no @@ -12,7 +12,7 @@ services: rtr-client-2: image: ${RPKI_RTR_CLIENT_IMAGE:-rpki-rtr-debug-client:latest} - command: ["${RPKI_RTR_SERVER_ADDR:-rpki-rtr-tcp:323}", "${RPKI_RTR_PROTOCOL_VERSION:-2}", "reset", "--keep-after-error", "--summary-only"] + command: ["${RPKI_RTR_TCP_SERVER_ADDR:-rpki-rtr:323}", "${RPKI_RTR_PROTOCOL_VERSION:-2}", "reset", "--keep-after-error", "--summary-only"] volumes: - ${RPKI_RTR_CLIENT_LOG_HOST_DIR:-../../logs/client}:/app/logs restart: no @@ -21,7 +21,7 @@ services: rtr-client-3: image: ${RPKI_RTR_CLIENT_IMAGE:-rpki-rtr-debug-client:latest} - command: ["${RPKI_RTR_SERVER_ADDR:-rpki-rtr-tcp:323}", "${RPKI_RTR_PROTOCOL_VERSION:-2}", "reset", "--keep-after-error", "--summary-only"] + command: ["${RPKI_RTR_TCP_SERVER_ADDR:-rpki-rtr:323}", "${RPKI_RTR_PROTOCOL_VERSION:-2}", "reset", "--keep-after-error", "--summary-only"] volumes: - ${RPKI_RTR_CLIENT_LOG_HOST_DIR:-../../logs/client}:/app/logs restart: no @@ -30,7 +30,7 @@ services: rtr-client-4: image: ${RPKI_RTR_CLIENT_IMAGE:-rpki-rtr-debug-client:latest} - command: ["${RPKI_RTR_SERVER_ADDR:-rpki-rtr-tcp:323}", "${RPKI_RTR_PROTOCOL_VERSION:-2}", "reset", "--keep-after-error", "--summary-only"] + command: ["${RPKI_RTR_TCP_SERVER_ADDR:-rpki-rtr:323}", "${RPKI_RTR_PROTOCOL_VERSION:-2}", "reset", "--keep-after-error", "--summary-only"] volumes: - ${RPKI_RTR_CLIENT_LOG_HOST_DIR:-../../logs/client}:/app/logs restart: no @@ -39,7 +39,7 @@ services: rtr-client-5: image: ${RPKI_RTR_CLIENT_IMAGE:-rpki-rtr-debug-client:latest} - command: ["${RPKI_RTR_SERVER_ADDR:-rpki-rtr-tcp:323}", "${RPKI_RTR_PROTOCOL_VERSION:-2}", "reset", "--keep-after-error", "--summary-only"] + command: ["${RPKI_RTR_TCP_SERVER_ADDR:-rpki-rtr:323}", "${RPKI_RTR_PROTOCOL_VERSION:-2}", "reset", "--keep-after-error", "--summary-only"] volumes: - ${RPKI_RTR_CLIENT_LOG_HOST_DIR:-../../logs/client}:/app/logs restart: no diff --git a/deploy/client/docker-compose.ssh.password.yml b/deploy/client/docker-compose.ssh.password.yml index 0d4bc05..21ab07a 100644 --- a/deploy/client/docker-compose.ssh.password.yml +++ b/deploy/client/docker-compose.ssh.password.yml @@ -8,7 +8,7 @@ services: image: ${RPKI_RTR_CLIENT_IMAGE:-rpki-rtr-debug-client:latest} command: [ - "${RPKI_RTR_SERVER_ADDR:-rpki-rtr-ssh:22}", + "${RPKI_RTR_SSH_SERVER_ADDR:-rpki-rtr:22}", "${RPKI_RTR_PROTOCOL_VERSION:-2}", "reset", "--ssh", @@ -22,7 +22,7 @@ services: "--summary-only" ] volumes: - - ${RPKI_RTR_CLIENT_KEYS_VOLUME:-../../certs:/app/certs:ro} + - ${RPKI_RTR_CLIENT_KEYS_VOLUME:-../../certs/ssh:/app/certs:ro} - ${RPKI_RTR_CLIENT_LOG_HOST_DIR:-../../logs/client}:/app/logs restart: no stdin_open: true diff --git a/deploy/client/docker-compose.ssh.yml b/deploy/client/docker-compose.ssh.yml index 3b477e5..2b1c2de 100644 --- a/deploy/client/docker-compose.ssh.yml +++ b/deploy/client/docker-compose.ssh.yml @@ -8,7 +8,7 @@ services: image: ${RPKI_RTR_CLIENT_IMAGE:-rpki-rtr-debug-client:latest} command: [ - "${RPKI_RTR_SERVER_ADDR:-rpki-rtr-ssh:22}", + "${RPKI_RTR_SSH_SERVER_ADDR:-rpki-rtr:22}", "${RPKI_RTR_PROTOCOL_VERSION:-2}", "reset", "--ssh", @@ -22,7 +22,7 @@ services: "--summary-only" ] volumes: - - ${RPKI_RTR_CLIENT_KEYS_VOLUME:-../../certs:/app/certs:ro} + - ${RPKI_RTR_CLIENT_KEYS_VOLUME:-../../certs/ssh:/app/certs:ro} - ${RPKI_RTR_CLIENT_LOG_HOST_DIR:-../../logs/client}:/app/logs restart: no stdin_open: true diff --git a/deploy/client/docker-compose.tcp.yml b/deploy/client/docker-compose.tcp.yml index 3d3cb86..ec62139 100644 --- a/deploy/client/docker-compose.tcp.yml +++ b/deploy/client/docker-compose.tcp.yml @@ -4,7 +4,7 @@ services: context: ../.. dockerfile: deploy/client/Dockerfile image: ${RPKI_RTR_CLIENT_IMAGE:-rpki-rtr-debug-client:latest} - command: ["${RPKI_RTR_SERVER_ADDR:-rpki-rtr-tcp:323}", "${RPKI_RTR_PROTOCOL_VERSION:-2}", "reset", "--keep-after-error", "--summary-only"] + command: ["${RPKI_RTR_TCP_SERVER_ADDR:-rpki-rtr:323}", "${RPKI_RTR_PROTOCOL_VERSION:-2}", "reset", "--keep-after-error", "--summary-only"] volumes: - ${RPKI_RTR_CLIENT_LOG_HOST_DIR:-../../logs/client}:/app/logs restart: no diff --git a/deploy/client/docker-compose.tls.yml b/deploy/client/docker-compose.tls.yml index 4c88d83..4ff070e 100644 --- a/deploy/client/docker-compose.tls.yml +++ b/deploy/client/docker-compose.tls.yml @@ -8,7 +8,7 @@ services: image: ${RPKI_RTR_CLIENT_IMAGE:-rpki-rtr-debug-client:latest} command: [ - "${RPKI_RTR_SERVER_ADDR:-rpki-rtr-tls:324}", + "${RPKI_RTR_TLS_SERVER_ADDR:-rpki-rtr:324}", "${RPKI_RTR_PROTOCOL_VERSION:-2}", "reset", "--tls", @@ -24,7 +24,7 @@ services: "--summary-only" ] volumes: - - ${RPKI_RTR_TLS_CERTS_HOST_DIR:-../../tests/fixtures/tls}:/app/certs:ro + - ${RPKI_RTR_TLS_CERTS_HOST_DIR:-../../certs/tls}:/app/certs:ro - ${RPKI_RTR_CLIENT_LOG_HOST_DIR:-../../logs/client}:/app/logs restart: no stdin_open: true diff --git a/deploy/client/docker-compose.yml b/deploy/client/docker-compose.yml index 3d3cb86..ec62139 100644 --- a/deploy/client/docker-compose.yml +++ b/deploy/client/docker-compose.yml @@ -4,7 +4,7 @@ services: context: ../.. dockerfile: deploy/client/Dockerfile image: ${RPKI_RTR_CLIENT_IMAGE:-rpki-rtr-debug-client:latest} - command: ["${RPKI_RTR_SERVER_ADDR:-rpki-rtr-tcp:323}", "${RPKI_RTR_PROTOCOL_VERSION:-2}", "reset", "--keep-after-error", "--summary-only"] + command: ["${RPKI_RTR_TCP_SERVER_ADDR:-rpki-rtr:323}", "${RPKI_RTR_PROTOCOL_VERSION:-2}", "reset", "--keep-after-error", "--summary-only"] volumes: - ${RPKI_RTR_CLIENT_LOG_HOST_DIR:-../../logs/client}:/app/logs restart: no diff --git a/deploy/frr/.env b/deploy/frr/.env new file mode 100644 index 0000000..3e58fc5 --- /dev/null +++ b/deploy/frr/.env @@ -0,0 +1,4 @@ +# RTR server endpoint used by deploy/frr/frr.conf.template. +RPKI_FRR_RPKI_HOST=127.0.0.1 +RPKI_FRR_RPKI_PORT=323 +RPKI_FRR_RPKI_PREFERENCE=1 diff --git a/deploy/frr/README.md b/deploy/frr/README.md index b23d1a0..43d371f 100644 --- a/deploy/frr/README.md +++ b/deploy/frr/README.md @@ -15,7 +15,10 @@ Reference: ## Files - `daemons.example`: sample `/etc/frr/daemons` -- `frr.conf.example`: sample `/etc/frr/frr.conf` +- `frr.conf.example`: static sample `/etc/frr/frr.conf` +- `frr.conf.template`: Docker template used to generate `/etc/frr/frr.conf` +- `entrypoint.sh`: renders `frr.conf.template` from environment variables before starting FRR +- `.env`: default Docker environment values ## How to apply on an FRR host @@ -44,21 +47,32 @@ contains VRPs, the RTR client path is working. From repository root: ```bash -docker compose -f deploy/frr/docker-compose.yml up -d +docker compose --env-file deploy/frr/.env -f deploy/frr/docker-compose.yml up -d docker exec -it frr-rpki-client vtysh -c "show rpki cache-connection" docker exec -it frr-rpki-client vtysh -c "show rpki prefix-table" ``` +The Docker example defaults to `127.0.0.1:323`. Override the RTR server +endpoint with environment variables: + +```bash +RPKI_FRR_RPKI_HOST=10.0.0.12 \ +RPKI_FRR_RPKI_PORT=323 \ +docker compose --env-file deploy/frr/.env -f deploy/frr/docker-compose.yml up -d +``` + Stop: ```bash -docker compose -f deploy/frr/docker-compose.yml down +docker compose --env-file deploy/frr/.env -f deploy/frr/docker-compose.yml down ``` ## Notes - This setup targets RTR over TCP (`rpki cache tcp`). +- Docker mode renders `frr.conf.template` into `/etc/frr/frr.conf` at startup. - Keep protocol-level conformance checks in Rust tests and `src/bin/rtr_debug_client`. -- `network_mode: host` expects your RTR server to be reachable at - `127.0.0.1:323` from the Docker host. +- `network_mode: host` is kept for the minimal FRR container example, but the + RTR server address is controlled by `RPKI_FRR_RPKI_HOST` and + `RPKI_FRR_RPKI_PORT`. diff --git a/deploy/frr/README.zh.md b/deploy/frr/README.zh.md index 07f4c7e..33beaf1 100644 --- a/deploy/frr/README.zh.md +++ b/deploy/frr/README.zh.md @@ -12,7 +12,10 @@ ## 文件说明 - `daemons.example`：示例 `/etc/frr/daemons` -- `frr.conf.example`：示例 `/etc/frr/frr.conf` +- `frr.conf.example`：静态示例 `/etc/frr/frr.conf` +- `frr.conf.template`：Docker 启动时生成 `/etc/frr/frr.conf` 的模板 +- `entrypoint.sh`：启动 FRR 前根据环境变量渲染 `frr.conf.template` +- `.env`：Docker 示例使用的默认环境变量 ## 在 FRR 主机上应用 @@ -40,15 +43,23 @@ vtysh -c "show rpki prefix-table" 在仓库根目录执行： ```bash -docker compose -f deploy/frr/docker-compose.yml up -d +docker compose --env-file deploy/frr/.env -f deploy/frr/docker-compose.yml up -d docker exec -it frr-rpki-client vtysh -c "show rpki cache-connection" docker exec -it frr-rpki-client vtysh -c "show rpki prefix-table" ``` +Docker 示例默认连接 `127.0.0.1:323`。如果 RTR Server 在其他地址，可以通过环境变量覆盖： + +```bash +RPKI_FRR_RPKI_HOST=10.0.0.12 \ +RPKI_FRR_RPKI_PORT=323 \ +docker compose --env-file deploy/frr/.env -f deploy/frr/docker-compose.yml up -d +``` + 停止： ```bash -docker compose -f deploy/frr/docker-compose.yml down +docker compose --env-file deploy/frr/.env -f deploy/frr/docker-compose.yml down ``` ## 可测试范围 @@ -68,4 +79,5 @@ docker compose -f deploy/frr/docker-compose.yml down ## 说明 - 当前示例主要针对 RTR over TCP（`rpki cache tcp`） -- `network_mode: host` 模式下，容器内访问 `127.0.0.1:323` 指向 Docker Host，请确保本机 RTR Server 可达 +- Docker 模式会在启动时把 `frr.conf.template` 渲染为 `/etc/frr/frr.conf` +- `network_mode: host` 仍用于最小化 FRR 容器示例，但 RTR Server 地址由 `RPKI_FRR_RPKI_HOST` 和 `RPKI_FRR_RPKI_PORT` 控制 diff --git a/deploy/frr/docker-compose.yml b/deploy/frr/docker-compose.yml index 32cfe59..0416c6a 100644 --- a/deploy/frr/docker-compose.yml +++ b/deploy/frr/docker-compose.yml @@ -5,6 +5,12 @@ services: restart: unless-stopped network_mode: host privileged: true + environment: + RPKI_FRR_RPKI_HOST: "${RPKI_FRR_RPKI_HOST:-127.0.0.1}" + RPKI_FRR_RPKI_PORT: "${RPKI_FRR_RPKI_PORT:-323}" + RPKI_FRR_RPKI_PREFERENCE: "${RPKI_FRR_RPKI_PREFERENCE:-1}" + entrypoint: ["/bin/sh", "/config/entrypoint.sh"] volumes: - - ./frr/daemons.example:/etc/frr/daemons:ro - - ./frr/frr.conf.example:/etc/frr/frr.conf:ro \ No newline at end of file + - ./daemons.example:/etc/frr/daemons:ro + - ./frr.conf.template:/config/frr.conf.template:ro + - ./entrypoint.sh:/config/entrypoint.sh:ro diff --git a/deploy/frr/entrypoint.sh b/deploy/frr/entrypoint.sh new file mode 100644 index 0000000..b7963c9 --- /dev/null +++ b/deploy/frr/entrypoint.sh @@ -0,0 +1,24 @@ +#!/bin/sh +set -eu + +: "${RPKI_FRR_RPKI_HOST:=127.0.0.1}" +: "${RPKI_FRR_RPKI_PORT:=323}" +: "${RPKI_FRR_RPKI_PREFERENCE:=1}" +: "${RPKI_FRR_CONFIG_TEMPLATE_PATH:=/config/frr.conf.template}" +: "${RPKI_FRR_CONFIG_PATH:=/etc/frr/frr.conf}" + +escape_sed() { + printf '%s' "$1" | sed 's/[&|\\]/\\&/g' +} + +host="$(escape_sed "${RPKI_FRR_RPKI_HOST}")" +port="$(escape_sed "${RPKI_FRR_RPKI_PORT}")" +preference="$(escape_sed "${RPKI_FRR_RPKI_PREFERENCE}")" + +sed \ + -e "s|\${RPKI_FRR_RPKI_HOST}|${host}|g" \ + -e "s|\${RPKI_FRR_RPKI_PORT}|${port}|g" \ + -e "s|\${RPKI_FRR_RPKI_PREFERENCE}|${preference}|g" \ + "${RPKI_FRR_CONFIG_TEMPLATE_PATH}" > "${RPKI_FRR_CONFIG_PATH}" + +exec /usr/lib/frr/docker-start diff --git a/deploy/frr/frr.conf.template b/deploy/frr/frr.conf.template new file mode 100644 index 0000000..1111f24 --- /dev/null +++ b/deploy/frr/frr.conf.template @@ -0,0 +1,22 @@ +frr version 10.2 +frr defaults traditional +hostname rpki-lab +service integrated-vtysh-config +! +debug rpki +! +rpki + rpki polling_period 10 + rpki timeout 10 + rpki retry_interval 10 + rpki expire_interval 7200 + rpki cache tcp ${RPKI_FRR_RPKI_HOST} ${RPKI_FRR_RPKI_PORT} preference ${RPKI_FRR_RPKI_PREFERENCE} + exit +! +router bgp 65001 + bgp router-id 192.0.2.1 + ! + address-family ipv4 unicast + exit-address-family +! +line vty diff --git a/deploy/server/.env b/deploy/server/.env index 577c017..aeb492f 100644 --- a/deploy/server/.env +++ b/deploy/server/.env @@ -5,10 +5,6 @@ RPKI_RTR_SLURM_HOST_DIR=../../data # In-container data source directories. RPKI_RTR_CCR_DIR=/app/data RPKI_RTR_SLURM_DIR=/app/slurm - -# Persistent directories on host. -RPKI_RTR_DB_HOST_DIR=../../rtr-db -RPKI_RTR_LOG_HOST_DIR=../../logs/server RPKI_RTR_REPORT_HOST_DIR=../../report # In-container runtime paths. @@ -16,6 +12,9 @@ RPKI_RTR_DB_PATH=/app/rtr-db RPKI_RTR_REPORT_DIR=/app/report # Core runtime knobs. +# Persistent directories on host. +RPKI_RTR_DB_HOST_DIR=../../rtr-db +RPKI_RTR_LOG_HOST_DIR=../../logs/server RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS=300 RPKI_RTR_RUNTIME_REPORT_INTERVAL_SECS=300 RPKI_RTR_REPORT_HISTORY_LIMIT=10 @@ -32,7 +31,8 @@ RPKI_RTR_ENFORCE_TLS_CLIENT_SAN_IP_MATCH=false RPKI_RTR_TLS_CERT_PATH=/app/certs/server-dns.crt RPKI_RTR_TLS_KEY_PATH=/app/certs/server-dns.key RPKI_RTR_TLS_CLIENT_CA_PATH=/app/certs/client-ca.crt -RPKI_RTR_TLS_CERTS_HOST_DIR=../../tests/fixtures/tls + +RPKI_RTR_TLS_CERTS_HOST_DIR=../../certs/tls # SSH mode knobs. RPKI_RTR_SSH_HOST_PORT=2222 @@ -40,7 +40,7 @@ RPKI_RTR_SSH_CONTAINER_PORT=22 RPKI_RTR_SSH_AUTH_MODE=key RPKI_RTR_SSH_USERNAME=rpki-rtr RPKI_RTR_SSH_SUBSYSTEM_NAME=rpki-rtr -RPKI_RTR_SSH_HOST_KEY_PATH=/host-ssh/ssh_host_ed25519_key +RPKI_RTR_SSH_HOST_KEY_PATH=/app/certs/ssh_host_rsa_key RPKI_RTR_SSH_AUTHORIZED_KEYS_PATH=/app/certs/rtr-authorized_keys -RPKI_RTR_SSH_KEYS_VOLUME=/etc/ssh:/host-ssh:ro -RPKI_RTR_SSH_CERTS_HOST_DIR=../../certs + +RPKI_RTR_SSH_CERTS_HOST_DIR=../../certs/ssh diff --git a/deploy/server/DEPLOYMENT.md b/deploy/server/DEPLOYMENT.md index ae13258..4fdb1c3 100644 --- a/deploy/server/DEPLOYMENT.md +++ b/deploy/server/DEPLOYMENT.md @@ -38,7 +38,7 @@ The container runs `rpki` directly as PID 1. - Core: `RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS`, `RPKI_RTR_MAX_DELTA`, `RPKI_RTR_MAX_CONCURRENT_HANDSHAKES`, `RPKI_RTR_RUNTIME_REPORT_INTERVAL_SECS`, `RPKI_RTR_REPORT_HISTORY_LIMIT`, `RPKI_RTR_TIMEZONE`, `RPKI_RTR_ADMIN_ADDR`, `RPKI_RTR_ADMIN_TOKEN`, `RUST_LOG` - TCP mode: `RPKI_RTR_MAX_CONNECTIONS` - TLS mode: `RPKI_RTR_ENFORCE_TLS_CLIENT_SAN_IP_MATCH`, `RPKI_RTR_TLS_CERT_PATH`, `RPKI_RTR_TLS_KEY_PATH`, `RPKI_RTR_TLS_CLIENT_CA_PATH`, `RPKI_RTR_TLS_CERTS_HOST_DIR` -- SSH mode: `RPKI_RTR_SSH_HOST_PORT`, `RPKI_RTR_SSH_CONTAINER_PORT`, `RPKI_RTR_SSH_AUTH_MODE`, `RPKI_RTR_SSH_USERNAME`, `RPKI_RTR_SSH_SUBSYSTEM_NAME`, `RPKI_RTR_SSH_HOST_KEY_PATH`, `RPKI_RTR_SSH_AUTHORIZED_KEYS_PATH`, `RPKI_RTR_SSH_KEYS_VOLUME`, `RPKI_RTR_SSH_CERTS_HOST_DIR` +- SSH mode: `RPKI_RTR_SSH_HOST_PORT`, `RPKI_RTR_SSH_CONTAINER_PORT`, `RPKI_RTR_SSH_AUTH_MODE`, `RPKI_RTR_SSH_USERNAME`, `RPKI_RTR_SSH_SUBSYSTEM_NAME`, `RPKI_RTR_SSH_HOST_KEY_PATH`, `RPKI_RTR_SSH_AUTHORIZED_KEYS_PATH`, `RPKI_RTR_SSH_CERTS_HOST_DIR` ## Start diff --git a/deploy/server/docker-compose.ssh.yml b/deploy/server/docker-compose.ssh.yml index 8258673..97397e9 100644 --- a/deploy/server/docker-compose.ssh.yml +++ b/deploy/server/docker-compose.ssh.yml @@ -17,7 +17,7 @@ services: RPKI_RTR_ENABLE_SSH: "true" RPKI_RTR_TCP_ADDR: "0.0.0.0:323" RPKI_RTR_SSH_ADDR: "0.0.0.0:${RPKI_RTR_SSH_CONTAINER_PORT:-22}" - RPKI_RTR_SSH_HOST_KEY_PATH: "${RPKI_RTR_SSH_HOST_KEY_PATH:-/host-ssh/ssh_host_ed25519_key}" + RPKI_RTR_SSH_HOST_KEY_PATH: "${RPKI_RTR_SSH_HOST_KEY_PATH:-/app/certs/ssh_host_rsa_key}" RPKI_RTR_SSH_AUTHORIZED_KEYS_PATH: "${RPKI_RTR_SSH_AUTHORIZED_KEYS_PATH:-/app/certs/rtr-authorized_keys}" RPKI_RTR_SSH_USERNAME: "${RPKI_RTR_SSH_USERNAME:-rpki-rtr}" RPKI_RTR_SSH_SUBSYSTEM_NAME: "${RPKI_RTR_SSH_SUBSYSTEM_NAME:-rpki-rtr}" @@ -42,8 +42,7 @@ services: - ${RPKI_RTR_CCR_HOST_DIR:-../../data}:${RPKI_RTR_CCR_DIR:-/app/data}:ro - ${RPKI_RTR_DB_HOST_DIR:-../../rtr-db}:${RPKI_RTR_DB_PATH:-/app/rtr-db} - ${RPKI_RTR_SLURM_HOST_DIR:-../../data}:${RPKI_RTR_SLURM_DIR:-/app/slurm} - - ${RPKI_RTR_SSH_KEYS_VOLUME:-/etc/ssh:/host-ssh:ro} - - ${RPKI_RTR_SSH_CERTS_HOST_DIR:-../../certs}:/app/certs:ro + - ${RPKI_RTR_SSH_CERTS_HOST_DIR:-../../certs/ssh}:/app/certs:ro - ${RPKI_RTR_LOG_HOST_DIR:-../../logs/server}:/app/logs - ${RPKI_RTR_REPORT_HOST_DIR:-../../report}:${RPKI_RTR_REPORT_DIR:-/app/report} networks: diff --git a/deploy/server/docker-compose.tls.yml b/deploy/server/docker-compose.tls.yml index 690bcd5..b7a2b72 100644 --- a/deploy/server/docker-compose.tls.yml +++ b/deploy/server/docker-compose.tls.yml @@ -36,7 +36,7 @@ services: - ${RPKI_RTR_CCR_HOST_DIR:-../../data}:${RPKI_RTR_CCR_DIR:-/app/data}:ro - ${RPKI_RTR_DB_HOST_DIR:-../../rtr-db}:${RPKI_RTR_DB_PATH:-/app/rtr-db} - ${RPKI_RTR_SLURM_HOST_DIR:-../../data}:${RPKI_RTR_SLURM_DIR:-/app/slurm} - - ${RPKI_RTR_TLS_CERTS_HOST_DIR:-../../tests/fixtures/tls}:/app/certs:ro + - ${RPKI_RTR_TLS_CERTS_HOST_DIR:-../../certs/tls}:/app/certs:ro - ${RPKI_RTR_LOG_HOST_DIR:-../../logs/server}:/app/logs - ${RPKI_RTR_REPORT_HOST_DIR:-../../report}:${RPKI_RTR_REPORT_DIR:-/app/report} networks: diff --git a/deploy/server/docker-compose.yml b/deploy/server/docker-compose.yml index be60aa9..32ffd83 100644 --- a/deploy/server/docker-compose.yml +++ b/deploy/server/docker-compose.yml @@ -35,7 +35,7 @@ services: # RPKI_RTR_ENABLE_SSH: "true" # RPKI_RTR_SSH_ADDR: "0.0.0.0:22" # RPKI_RTR_SSH_PORT: "22" - # RPKI_RTR_SSH_HOST_KEY_PATH: "/app/certs/ssh_host_ed25519_key" + # RPKI_RTR_SSH_HOST_KEY_PATH: "/app/certs/ssh_host_rsa_key" # RPKI_RTR_SSH_AUTHORIZED_KEYS_PATH: "/app/certs/rtr-authorized_keys" # RPKI_RTR_SSH_USERNAME: "rpki-rtr" # RPKI_RTR_SSH_SUBSYSTEM_NAME: "rpki-rtr" @@ -48,7 +48,7 @@ services: - ${RPKI_RTR_LOG_HOST_DIR:-../../logs/server}:/app/logs - ${RPKI_RTR_REPORT_HOST_DIR:-../../report}:${RPKI_RTR_REPORT_DIR:-/app/report} # TLS mode example: - # - ../../certs:/app/certs:ro + # - ../../certs/ssh:/app/certs:ro networks: - rpki_net diff --git a/src/rtr/config.rs b/src/rtr/config.rs index 1f0c934..dca6f1a 100644 --- a/src/rtr/config.rs +++ b/src/rtr/config.rs @@ -94,11 +94,11 @@ impl Default for AppConfig { db_path: "./rtr-db".to_string(), ccr_dir: "./data".to_string(), slurm_dir: None, - tls_cert_path: "./certs/server.crt".to_string(), - tls_key_path: "./certs/server.key".to_string(), - tls_client_ca_path: "./certs/client-ca.crt".to_string(), - ssh_host_key_path: "./certs/ssh_host_ed25519_key".to_string(), - ssh_authorized_keys_path: "./certs/rtr-authorized_keys".to_string(), + tls_cert_path: "./certs/tls/server-dns.crt".to_string(), + tls_key_path: "./certs/tls/server-dns.key".to_string(), + tls_client_ca_path: "./certs/tls/client-ca.crt".to_string(), + ssh_host_key_path: "./certs/ssh/ssh_host_rsa_key".to_string(), + ssh_authorized_keys_path: "./certs/ssh/rtr-authorized_keys".to_string(), ssh_username: "rpki-rtr".to_string(), ssh_subsystem_name: "rpki-rtr".to_string(), ssh_auth_mode: SshAuthMode::Key,