102 lines
4.4 KiB
Markdown
102 lines
4.4 KiB
Markdown
# Usage
|
|
|
|
Examples assume `panda-rpki` is on PATH; for a local build use
|
|
`target/release/panda-rpki`. Prepare TAL/TA files as described in
|
|
[Getting started](getting-started.md).
|
|
|
|
## Snapshot and delta
|
|
|
|
Use a fresh state directory for an explicit snapshot:
|
|
|
|
```bash
|
|
panda-rpki validate --tal input/anchor.tal --ta input/anchor.cer \
|
|
--rrdp-state-dir state/anchor --rrdp-sync-mode snapshot \
|
|
--out output/snapshot --ccr-out output/snapshot/result.ccr
|
|
panda-rpki validate --tal input/anchor.tal --ta input/anchor.cer \
|
|
--rrdp-state-dir state/anchor --rrdp-sync-mode delta \
|
|
--out output/delta-01 --ccr-out output/delta-01/result.ccr
|
|
```
|
|
|
|
Subsequent runs reuse state and can use `auto`. Delta mode can include a
|
|
protocol-required snapshot or noop. Check actual operation counters in the
|
|
summary. Do not discard persistent state between scheduled runs.
|
|
|
|
## Multiple anchors and constraints
|
|
|
|
```bash
|
|
panda-rpki validate \
|
|
--tal input/arin.tal --ta input/arin.cer --tal-id arin \
|
|
--tal input/ripe.tal --ta input/ripe.cer --tal-id ripe \
|
|
--parallel-max-repo-sync-workers-global 8 \
|
|
--parallel-phase2-object-workers 8 \
|
|
--rrdp-state-dir state/multi --out output/multi \
|
|
--ccr-out output/multi/result.ccr
|
|
```
|
|
|
|
Add further pairs in the same way. Optional resource constraints are read from
|
|
the TAL-adjacent `.constraints` file, or specified with
|
|
`--ta-constraints arin=input/arin.constraints`. Rules follow the WG profile
|
|
listed in the [standards matrix](conformance-matrix.md).
|
|
|
|
A constraint file contains `allow`/`deny` followed by an IPv4/IPv6 prefix,
|
|
address range, ASN or ASN range. Blank lines and `#` comments are allowed.
|
|
For a synthetic test anchor, an example is:
|
|
|
|
```text
|
|
# Example resources only: do not apply this policy to a production RIR.
|
|
allow 192.0.2.0/24
|
|
deny 192.0.2.128/25
|
|
allow 2001:db8::/32
|
|
allow 64496 - 64511
|
|
```
|
|
|
|
Deny overlap rejects an EE resource; otherwise the resource must be fully
|
|
covered by allow rules of its resource family. Unlisted resources are not
|
|
implicitly allowed. An empty constraint file therefore differs from having
|
|
no constraint file. Overlapping rules are normalized and may produce warnings.
|
|
|
|
## Continuous operation
|
|
|
|
```bash
|
|
panda-rpki daemon --state-root data/daemon \
|
|
--interval-secs 600 --retain-runs 10 -- \
|
|
--tal input/anchor.tal --ta input/anchor.cer \
|
|
--log-level info --log-format json
|
|
```
|
|
|
|
The daemon runs in the foreground. It starts with snapshot for empty state and
|
|
requests delta after successful runs. The interval starts after each cycle
|
|
finishes. Add `--max-runs 3` before `--` for a finite run. SIGTERM requests a
|
|
graceful stop. Restart with the same root to continue numbering and state.
|
|
|
|
Each cycle writes to `data/daemon/runs/run_000001/`, then `run_000002/`, etc.
|
|
Retention deletes the oldest completed run directories beyond the configured
|
|
limit, including their artifacts. Copy anything you need to retain elsewhere.
|
|
The append-only summary history is not trimmed by retention.
|
|
|
|
## Outputs and diagnostics
|
|
|
|
`vrps.csv` contains `asn,prefix,max_length`. CCR contains canonical state;
|
|
duplicate routing payloads can collapse into a single CCR entry. Count raw
|
|
rows and normalized unique payloads separately when comparing outputs.
|
|
ASPA canonicalization groups providers by customer ASN.
|
|
|
|
Use `--log-level debug` for diagnosis, or `trace` for detailed object/worker
|
|
events. Logs are written to stderr and can be redirected independently from
|
|
outputs. In daemon mode, inspect per-run `stderr.log` and the controller's
|
|
`daemon-status.json` and `run-summary.jsonl`.
|
|
|
|
| Symptom | Action |
|
|
| --- | --- |
|
|
| TAL/TA key mismatch or expired TA | Refresh the certificate from the TAL's official URI and check the selected pair. |
|
|
| State-layout/schema error | Preserve the directory and select a new dedicated root for a compatible run. |
|
|
| Snapshot refuses existing state | Use `auto`/`delta`, or choose a fresh directory for a new snapshot. |
|
|
| Delta refuses empty state | Establish state with `auto` or `snapshot`. |
|
|
| Permission denied in Docker | Pre-create writable host directories and use your UID/GID mapping. |
|
|
| RRDP origin rejection | Inspect the publisher's notification/references; extra TLS roots do not bypass origin policy. |
|
|
| Daemon root locked | Stop the other instance normally; do not delete its lock file. |
|
|
| Unexpected counts or partial output | Inspect warnings and per-run status; use new output paths to avoid stale files. |
|
|
|
|
See the [CLI reference](command-line-reference.md) for precise defaults,
|
|
timeouts, exit codes and recovery behavior.
|