Failing Repos
pmawsonau opened this issue · comments
When syncing on a new install, a number of repos are failing.
rsync: failed to connect to rpki.admin.freerangecloud.com (206.83.8.10): Connection refused (111)
rsync: failed to connect to rpki.admin.freerangecloud.com (2a0f:9400::10): Network is unreachable (101)
rsync error: error in socket IO (code 10) at clientserver.c(127) [Receiver=3.1.3]
rpki-client: rsync rsync://rpki.admin.freerangecloud.com/repo failed
rpki-client: rpki.admin.freerangecloud.com/repo/FRC-CA/2/5D35939557110CC43429AE301F7CEF0E5889942B.mft: No such file or directory
rpki-client: rpki.cnnic.cn/rpki/A9162E3D0000/73/CfUv1bVUg5EXd8PcpEpl08lfhYA.mft: No such file or directory
rpki-client: rpki.cnnic.cn/rpki/A9162E3D0000/643/PgsdlIaQ7Nxy4-Rg5eY-3pU8JOg.mft: No such file or directory
rpki-client: rpki.cnnic.cn/rpki/A9162E3D0000/423/Xb2Ek-hXQR0lkZ2GO7t9n_zfQCY.mft: No such file or directory
rpki-client: rpki.cnnic.cn/rpki/A9162E3D0000/2564/AnmNftzNSoJtCq5V0ivwHr_IVVI.roa: certificate revoked
rpki-client: rpki.cnnic.cn/rpki/A9162E3D0000/2564/WKekqyaWF89H6rKKH9ZgO10Ojw0.roa: certificate revoked
rpki-client: rpki.cnnic.cn/rpki/A9162E3D0000/577/Bnno7GYZdNImrE2NgOtA7VopH8Q.roa: certificate revoked
rpki-client: rpki.cnnic.cn/rpki/A9162E3D0000/577/HYSK6j9Pm4k6HObs3ehVIuOsemE.roa: certificate revoked
rpki-client: rpki.cnnic.cn/rpki/A9162E3D0000/577/JBqQNzyD7FX-A-kfxLTc29DLKUk.roa: certificate revoked
rpki-client: rpki-repo.registro.br/repo/FMn2RzF1dWSDso9K5bc7e9pWQxGMSSZ8LBGGfETtysRb/0/765A933C6C72EE2FEB3E9CD5814A88CEC6E9EDC2.mft: mft expired on Oct 8 06:00:00 2020 GMT
rpki-client: rpki-repo.registro.br/repo/Gva1RNWLQZKX2mKGX3ABNzDf2GUEmHtudn8iaAwPJ59b/0/59D5CE263BFC184A853E43C720B032327746D3F2.mft: mft expired on Oct 7 06:00:00 2020 GMT
rpki-client: rpki-repo.registro.br/repo/7MDsxHLp73maFuum97qTwY4sCSEve8jVP9X59WE1Czro/0/B585900CF5CFE343A114731C2BC86CDB52565A36.mft: mft expired on Oct 7 00:00:00 2020 GMT
rpki-client: rpki-repo.registro.br/repo/6tSMwGvMYudeQGttkP1cDt5DQGPrSgkBvhwYzfFwsvvD/0/24AE5DB2E35C9E374F3103B44A7914C203A9494F.mft: mft expired on Oct 4 12:00:00 2020 GMT
rpki-client: rpki.admin.freerangecloud.com/repo/FRC-CA/0/C8935FDCA5028AE8209FEC82AD8AE8CFB7C6E776.mft: No such file or directory
rsync: safe_read failed to read 1 bytes [Receiver]: Connection reset by peer (104)
rsync error: error in rsync protocol data stream (code 12) at io.c(276) [Receiver=3.1.3]
rpki-client: rsync rsync://rpki-ca.idnic.net/repo failed
rpki-client: rpki.admin.freerangecloud.com/repo/FRC-CA/1/DC9B0FC0FAE1CB3BD28B9D01AAFC3563FDA951DA.mft: No such file or directory
rpki-client: rpki-ca.idnic.net/repo/IDNIC-ID/1/C5E33A13006F4F97F48DD65B504E99749247F589.mft: No such file or directory
rpki-client: rpki-ca.idnic.net/repo/IDNIC-ID/0/38DC96F54A3D191028A636E98EE068E4AE207D76.mft: No such file or directory
rpki-client: rpki-ca.idnic.net/repo/IDNIC-ID/2/47C3384A753C3CB1369BF24D2BEAB816059D46C3.mft: No such file or directory
rpki-client: rpkica.mckay.com/rpki/MCnet/Jp4Tjp_GB5I1RfeaOGhKZNlDmAQ.mft: mft expired on Aug 26 11:03:34 2020 GMT
rpki-client: rpkica.mckay.com/rpki/MCnet/UEh2SAvdIgPsUFdv92RSSaNqBnY.mft: No such file or directory
This is showing a small, but significant, difference in ROAs compared to Routinator 3000. Is there an issue with the TAL files?
Validator: #IPv4/IPv6 records
Routinator 3000: 23:55:54 158440/27070
rpki-client: 156690/26644
Note that rpki.admin.freerangecloud.com seems to offer only RRDP, not rsync.
If you want to compare the rpki-client numbers with routinator, please use the latest rc routinator 0.8.0-rc2 version, otherwise you don't get 6486bis behavior and the numbers are therefor very different.
This number of warnings is correct and expected in today’s RPKI repositories on the Internet. In this sense - DNSSC and RPKI are quite similar: there will always be leaves of the hierarchy that operate suboptimal. When DNSSEC signatures are expired they result in “BOGUS” on validating DNS resolvers. When RPKI repositories have elements that are expired or files that are missing, it is considered invalid and thus no VRPs are emitted from the (now) distrusted publication point.
This implementation tends to err to the side of caution: if anything is wrong with the RPKI data it is safer to not produce VRPs from publication point.
When do we expect 0.8.0 to be released as GA and portable built?
You should ask the routinator team when routinator 0.8.0 will be released