93 lines
3.7 KiB
Markdown
93 lines
3.7 KiB
Markdown
# Panda RPKI
|
|
|
|
For every field, default, constraint and complete example, see the [TOML configuration reference](docs/configuration.md)。
|
|
|
|
Panda RPKI is an RPKI relying party written in Rust. It synchronizes repositories
|
|
over RRDP, validates signed objects, and exports routing data as CSV and Canonical
|
|
Cache Representation (CCR). Run a single cycle or use the daemon for continuous operation.
|
|
|
|
Version 0.1.0 is an unreleased candidate, validated on Linux x86-64. Other
|
|
platforms are not yet verified. Review the [standards and limitations](docs/conformance-matrix.md)
|
|
and [security policy](SECURITY.md) before evaluating it for routing use.
|
|
|
|
## Quick start
|
|
|
|
Requirements: Linux, Docker, and a TAL. A matching DER trust-anchor certificate
|
|
may be supplied in the TOML, or Panda can refresh it from the TAL's URI. Follow
|
|
[input preparation](docs/getting-started.md#prepare-trust-anchors) for trusted
|
|
RIR inputs. From the project root, after placing `input/anchor.tal` (and, for a
|
|
fixed-TA run, `input/anchor.cer`):
|
|
|
|
```bash
|
|
docker build -f docker/Dockerfile -t panda-rpki:v0.1.0 .
|
|
mkdir -p state output
|
|
cat > validate.toml <<'TOML'
|
|
config-version = 1
|
|
mode = "validate"
|
|
out = "/output"
|
|
rrdp-state-dir = "/state/repository"
|
|
ccr-out = "/output/result.ccr"
|
|
|
|
[[anchors]]
|
|
id = "anchor"
|
|
tal = "/input/anchor.tal"
|
|
# ta = "/input/anchor.cer" # uncomment for fixed TA mode
|
|
TOML
|
|
docker run --rm --read-only --tmpfs /tmp \
|
|
--user "$(id -u):$(id -g)" \
|
|
-v "$PWD/input:/input:ro" \
|
|
-v "$PWD/state:/state" \
|
|
-v "$PWD/output:/output" \
|
|
-v "$PWD/validate.toml:/config/validate.toml:ro" \
|
|
panda-rpki:v0.1.0 validate --config /config/validate.toml
|
|
```
|
|
|
|
The quick start refreshes the TA certificate automatically; TAL files themselves
|
|
remain operator-maintained. For complete single/all-five and daemon TOML files,
|
|
see [Compose examples](docker/examples/README.md).
|
|
|
|
Inspect `output/summary.json` and `output/vrps.csv`. Logs go to stderr.
|
|
Reuse the state directory to allow delta updates on subsequent runs.
|
|
For continuous operation see [Usage](docs/usage.md#continuous-operation).
|
|
|
|
## Features
|
|
|
|
- Multiple named anchors, fixed or automatically refreshed trust anchors, and
|
|
optional per-anchor resource constraints.
|
|
- RRDP snapshot, delta, replace/withdraw and protocol fallback.
|
|
- HTTPS same-origin checks for RRDP references and redirects.
|
|
- Independent bounded repository and object worker pools.
|
|
- CA, CRL, manifest, ROA, ASPA and BGPsec router-certificate processing.
|
|
- CSV, CCR, JSON summaries and configurable text or JSON logs from TOML.
|
|
- Daemon intervals, persistent state, run retention, timeouts and graceful stop.
|
|
|
|
Version 0.1.0 accepts HTTPS RRDP through its CLI. Operators supply explicit
|
|
TALs; automatic TA refresh follows each TAL's HTTPS or rsync URI. No RTR server
|
|
is included. See the
|
|
[standards matrix](docs/conformance-matrix.md) for profiles and limitations.
|
|
|
|
## Documentation
|
|
|
|
- [Getting started](docs/getting-started.md): dependencies, inputs and first run.
|
|
- [Five-RIR trust anchors](docs/trust-anchors.md): official TAL/TA downloads and checks.
|
|
- [Usage](docs/usage.md): multiple anchors, delta, daemon and troubleshooting.
|
|
- [Command-line reference](docs/command-line-reference.md): options and defaults.
|
|
- [Docker and Compose](docs/docker.md): single-anchor, all-five and daemon deployments.
|
|
- [Development and testing](docs/development.md).
|
|
- [Contributing](CONTRIBUTING.md) and [changelog](CHANGELOG.md).
|
|
- [Release checklist](docs/releasing.md).
|
|
|
|
## Build from source
|
|
|
|
Install Rust 1.92 or newer and the [native dependencies](docs/getting-started.md#build-from-source):
|
|
|
|
```bash
|
|
cargo build --locked --release
|
|
target/release/panda-rpki --help
|
|
```
|
|
|
|
## License
|
|
|
|
Panda RPKI uses the [BSD-3-Clause license](LICENSE).
|
|
See [third-party notices](THIRD_PARTY_NOTICES.md) for dependency attribution.
|