Panda RPKI

Panda RPKI is an RPKI relying party written in Rust. It synchronizes repositories over RRDP, validates signed objects, and exports routing data as CSV and Canonical Cache Representation (CCR). Run a single cycle or use the daemon for continuous operation.

Configuration is provided through TOML. See the TOML configuration reference for every field, default, constraint and complete example.

This build is validated on Linux x86-64. Other platforms are not yet verified. Review the standards and limitations and security policy before evaluating it for routing use.

Quick start

Requirements: Linux and Docker. This repository includes a pinned AFRINIC TAL and its constraints under tals/, so no TAL download or input/ setup is needed for this first run. A matching DER trust-anchor certificate may be supplied in the TOML, or Panda can refresh it from the TAL's URI. From the project root:

docker build -f docker/Dockerfile -t panda-rpki:local .
mkdir -p state output
cat > validate.toml <<'TOML'
config-version = 1
mode = "validate"
out = "/output"
rrdp-state-dir = "/state/repository"
ccr-out = "/output/result.ccr"

[[anchors]]
id = "afrinic"
tal = "/input/afrinic.tal"
constraints = "/input/afrinic.constraints"
# ta = "/input/afrinic.cer" # uncomment for fixed TA mode
TOML
docker run --rm --read-only --tmpfs /tmp \
  --user "$(id -u):$(id -g)" \
  -v "$PWD/tals:/input:ro" \
  -v "$PWD/state:/state" \
  -v "$PWD/output:/output" \
  -v "$PWD/validate.toml:/config/validate.toml:ro" \
  panda-rpki:local validate --config /config/validate.toml

The quick start refreshes the TA certificate automatically; TAL files themselves remain operator-maintained. For complete single/all-five and daemon TOML files, see Compose examples. The two all-five examples use the vendored OpenBSD TALs and constraints with resource constraints enabled. Edit the copied policy files or set top-level ta-constraints-enabled = false to disable them.

Inspect output/summary.json and output/vrps.csv. Logs go to stderr. Reuse the state directory to allow delta updates on subsequent runs. For continuous operation see Usage.

Features

Multiple named anchors, fixed or automatically refreshed trust anchors, and optional per-anchor resource constraints.
RRDP snapshot, delta, replace/withdraw and protocol fallback.
HTTPS same-origin checks for RRDP references and redirects.
Independent bounded repository and object worker pools.
CA, CRL, manifest, ROA, ASPA and BGPsec router-certificate processing.
CSV, CCR, JSON summaries and configurable text or JSON logs from TOML.
Daemon intervals, persistent state, run retention, timeouts and graceful stop.

The CLI accepts HTTPS RRDP. Operators supply explicit TALs; automatic TA refresh follows each TAL's HTTPS or rsync URI. No RTR server is included. See the standards matrix for profiles and limitations.

Documentation

Getting started: dependencies, inputs and first run.
Five-RIR trust anchors: official TAL/TA downloads and checks.
Usage: multiple anchors, delta, daemon and troubleshooting.
Command-line reference: options and defaults.
Docker and Compose: single-anchor, all-five and daemon deployments.
Development and testing.
Contributing and changelog.
Release checklist.

Build from source

Install Rust 1.92 or newer and the native dependencies:

cargo build --locked --release
target/release/panda-rpki --help

License

Panda RPKI uses the BSD-3-Clause license. See third-party notices for dependency attribution.

3.9 KiB Raw Blame History