96 lines
3.9 KiB
Markdown
96 lines
3.9 KiB
Markdown
# Panda RPKI
|
|
|
|
Panda RPKI is an RPKI relying party written in Rust. It synchronizes repositories
|
|
over RRDP, validates signed objects, and exports routing data as CSV and Canonical
|
|
Cache Representation (CCR). Run a single cycle or use the daemon for continuous operation.
|
|
|
|
Configuration is provided through TOML. See the [TOML configuration reference](docs/configuration.md)
|
|
for every field, default, constraint and complete example.
|
|
|
|
This build is validated on Linux x86-64. Other platforms are not yet verified.
|
|
Review the [standards and limitations](docs/conformance-matrix.md) and [security
|
|
policy](SECURITY.md) before evaluating it for routing use.
|
|
|
|
## Quick start
|
|
|
|
Requirements: Linux and Docker. This repository includes a pinned AFRINIC TAL and
|
|
its constraints under `tals/`, so no TAL download or `input/` setup is needed for
|
|
this first run. A matching DER trust-anchor certificate may be supplied in the
|
|
TOML, or Panda can refresh it from the TAL's URI. From the project root:
|
|
|
|
```bash
|
|
docker build -f docker/Dockerfile -t panda-rpki:local .
|
|
mkdir -p state output
|
|
cat > validate.toml <<'TOML'
|
|
config-version = 1
|
|
mode = "validate"
|
|
out = "/output"
|
|
rrdp-state-dir = "/state/repository"
|
|
ccr-out = "/output/result.ccr"
|
|
|
|
[[anchors]]
|
|
id = "afrinic"
|
|
tal = "/input/afrinic.tal"
|
|
constraints = "/input/afrinic.constraints"
|
|
# ta = "/input/afrinic.cer" # uncomment for fixed TA mode
|
|
TOML
|
|
docker run --rm --read-only --tmpfs /tmp \
|
|
--user "$(id -u):$(id -g)" \
|
|
-v "$PWD/tals:/input:ro" \
|
|
-v "$PWD/state:/state" \
|
|
-v "$PWD/output:/output" \
|
|
-v "$PWD/validate.toml:/config/validate.toml:ro" \
|
|
panda-rpki:local validate --config /config/validate.toml
|
|
```
|
|
|
|
The quick start refreshes the TA certificate automatically; TAL files themselves
|
|
remain operator-maintained. For complete single/all-five and daemon TOML files,
|
|
see [Compose examples](docker/examples/README.md). The two all-five examples
|
|
use the vendored [OpenBSD TALs and constraints](tals/README.md) with resource
|
|
constraints enabled. Edit the copied policy files or set top-level
|
|
`ta-constraints-enabled = false` to disable them.
|
|
|
|
Inspect `output/summary.json` and `output/vrps.csv`. Logs go to stderr.
|
|
Reuse the state directory to allow delta updates on subsequent runs.
|
|
For continuous operation see [Usage](docs/usage.md#continuous-operation).
|
|
|
|
## Features
|
|
|
|
- Multiple named anchors, fixed or automatically refreshed trust anchors, and
|
|
optional per-anchor resource constraints.
|
|
- RRDP snapshot, delta, replace/withdraw and protocol fallback.
|
|
- HTTPS same-origin checks for RRDP references and redirects.
|
|
- Independent bounded repository and object worker pools.
|
|
- CA, CRL, manifest, ROA, ASPA and BGPsec router-certificate processing.
|
|
- CSV, CCR, JSON summaries and configurable text or JSON logs from TOML.
|
|
- Daemon intervals, persistent state, run retention, timeouts and graceful stop.
|
|
|
|
The CLI accepts HTTPS RRDP. Operators supply explicit TALs; automatic TA refresh
|
|
follows each TAL's HTTPS or rsync URI. No RTR server is included. See the
|
|
[standards matrix](docs/conformance-matrix.md) for profiles and limitations.
|
|
|
|
## Documentation
|
|
|
|
- [Getting started](docs/getting-started.md): dependencies, inputs and first run.
|
|
- [Five-RIR trust anchors](docs/trust-anchors.md): official TAL/TA downloads and checks.
|
|
- [Usage](docs/usage.md): multiple anchors, delta, daemon and troubleshooting.
|
|
- [Command-line reference](docs/command-line-reference.md): options and defaults.
|
|
- [Docker and Compose](docs/docker.md): single-anchor, all-five and daemon deployments.
|
|
- [Development and testing](docs/development.md).
|
|
- [Contributing](CONTRIBUTING.md) and [changelog](CHANGELOG.md).
|
|
- [Release checklist](docs/releasing.md).
|
|
|
|
## Build from source
|
|
|
|
Install Rust 1.92 or newer and the [native dependencies](docs/getting-started.md#build-from-source):
|
|
|
|
```bash
|
|
cargo build --locked --release
|
|
target/release/panda-rpki --help
|
|
```
|
|
|
|
## License
|
|
|
|
Panda RPKI uses the [BSD-3-Clause license](LICENSE).
|
|
See [third-party notices](THIRD_PARTY_NOTICES.md) for dependency attribution.
|