cloudflare/octorpki
This is the standalone tool provided by Cloudflare to perform RPKI Validation. It should cover the most common use cases. It is the data provider behind https://rpki.cloudflare.com/rpki.json.
It can be used as a one-off or as an HTTP server (set -mode server|oneoff
).
The generated ROA list is compatible with GoRTR to provide routers the prefixes. The list can be signed using ECDSA signatures to be redistributed more securely (via a CDN or other caches).
It provides metrics on validation (times, numbers of files) and logs the requests.
All the files will be stored locally. The initialization time will vary and use by default RRDP then Rsync (failed RRDP will failover to Rsync).
It will keep fetching/revalidating until in a stable state (no new endpoints added).
By default, when unstable, the server will return 503
in order to avoid distributing partial data.
This feature can be disabled by passing -output.wait=false
.
The initial startup requires at least 3 iterations which takes around 5 minutes (while a refresh takes 2 minutes):
To install
$ go get github.com/cloudflare/cfrpki/cmd/octorpki
To run
$ cd ~/go/bin/
$ ./octorpki -h
It is also available as a docker container. Do not forget to add the TAL files in the tals/
folder.
$ mkdir tals && mkdir cache
$ docker run -ti -v $PWD/tals:/tals -v $PWD/cache:/cache -p 8080:8080 cloudflare/octorpki
Using the default settings, you can access the generated ROAs list on http://localhost:8080/output.json. Statistics are available on http://localhost:8080/infos in JSON. You can also plug a Prometheus server on the metrics endpoint http://localhost:8080/metrics.
In order to send the computed list of ROAs to the router, the router must be connected to a cache using RTR protocol.
OctoRPKI does not embed a RTR server. Since generating list of ROAs takes a lot of compute time, it was designed separate the distribution of files from the cryptographic operations.
GoRTR was created by Cloudflare to use a list of ROAs from either OctoRPKI or similar tools able to produce a JSON file.
To connect with GoRTR securely, you will need to setup a private key.
$ openssl ecparam -genkey -name prime256v1 -noout -outform pem > private.pem
You can force OctoRPKI to use the key by passing -output.sign.key private.pem
.
Then extract the public key
$ openssl ec -in private.pem -pubout -outform pem > public.pem
If OctoRPKI is running locally using the default port and file (http://localhost:8080/output.json), you can connect GoRTR:
$ ~/go/bin/gortr -verify.key public.pem -cache http://localhost:8080/output.json
To disable signing, use the following flag on OctoRPKI -output.sign=false
and -verify=false
on GoRTR.
You can then connect your router to GoRTR using the RPKI to Router Protocol (RTR).
Juniper instructions are available on the project's page.
docker pull cloudflare/octorpki