This PR introduces an additional layer for the key value store that can
keep global information. This is another step in preparation for
introducing support for database storage which will have connection
pools and such that are shared system-wide.
Since this storage system isn’t actually used yet, the PR for now is
just a massive refactoring and does not introduce any functional
changes.
This PR makes the storage_uri (aliased as data_dir) config option
mandatory and drops both it being read from an environment variable or
defaulting to ./data. Because of this, this is a breaking change.
This PR refactors how requests are processed in Krill. It creates a
clear distinction between the HTTP server running async on a Tokio
runtime and the core of Krill running as regular sync code on a thread
pool.
This means that those portions of the core that were previously async,
notable the HTTP requests to remote parents and publishers, end up
blocking a thread now. For most things this should be fine. For
potentially long-running tasks, we have a separate thread pool so they
won’t block all of Krill.
Breaking changes
* Reverted the use of Roto API for the ROA analysis to downloading
RISwhois route origin data and optimized the way this data is stored in
memory.
Removed the `bgp_api_enabled`, `bgp_api_uri`, and `bgp_api_cache_duration`
fields and added `bgp_riswhois_enabled`, `bgp_riswhois_v4_uri`,
`bgp_riswhois_v6_uri`, and `bgp_riswhois_refresh_duration` fields, all of
which are optional. ([#1329]
* Krill will now refuse to start if the config file contains unknown
options. ([#1322])
New
* A local `krillc` can now talk to the server via a Unix socket. In this
case it will use the name of the local user for authentication purposes.
By default, only the `root` user is allowed with the `admin` role, but
both allowed users and what role they are mapped to can be configure.
([#1322])
* Added a `krillc parents refresh` command to allow refreshing the parents
of a single CA rather than having to do a bulk refresh which can take a
very long time if there are many CAs. ([#1353])
Bug fixes
* Fixed an issue with the new BGP API code which false returns missing
announcement info. ([#1326])
* Fixed an issue where deleting children or parents of a CA fails before a
successful communication with the remote CA. ([#1331])
* Fixed an error message when trying to delete a CA which does not
have any parents, children, or repositories despite actually removing
the CA. ([#1331])
* Start sweeping the authenticator cache upon daemon startup. This merely
reduces memory consumption of the cache. Expired authentication tokens
were not used either way. ([#1337])
* Fixed a bug introduced in 0.15.0 where CAs do to not clear fulfilled
certification requests causing them to re-request a certificate every
time they contact their parent. ([#1345])
* Do not re-try syncing with a parent of a CA when that parent isn’t
known. ([#1349])
* Fixed un-suspending child CAs: rather then re-publishing the previously
revoked certificate, a new certificate is now issued. ([#1341])
Other changes
* The default config files don’t serve as config documentation any more.
Rather, there is now a `krill.conf.5` manual page. This manual page is
also included in the Krill manual. ([#1322])
* The cryptography library used by the rustls TLS implementation has been
switched to aws-lc-rs. This has some consequences for packaging:
* Dropped packaging for Ubuntu 20.04 (Focal Fossa). ([#1359])
Breaking changes
* Reverted the use of Roto API for the ROA analysis to downloading
RISwhois route origin data and optimized the way this data is stored in
memory.
Removed the `bgp_api_enabled`, `bgp_api_uri`, and `bgp_api_cache_duration`
fields and added `bgp_riswhois_enabled`, `bgp_riswhois_v4_uri`,
`bgp_riswhois_v6_uri`, and `bgp_riswhois_refresh_duration` fields, all of
which are optional. ([#1329]
* Krill will now refuse to start if the config file contains unknown
options. ([#1322])
New
* A local `krillc` can now talk to the server via a Unix socket. In this
case it will use the name of the local user for authentication purposes.
By default, only the `root` user is allowed with the `admin` role, but
both allowed users and what role they are mapped to can be configure.
([#1322])
* Added a `krillc parents refresh` command to allow refreshing the parents
of a single CA rather than having to do a bulk refresh which can take a
very long time if there are many CAs. ([#1353])
Bug fixes
* Fixed an issue with the new BGP API code which false returns missing
announcement info. ([#1326])
* Fixed an issue where deleting children or parents of a CA fails before a
successful communication with the remote CA. ([#1331])
* Fixed an error message when trying to delete a CA which does not
have any parents, children, or repositories despite actually removing
the CA. ([#1331])
* Start sweeping the authenticator cache upon daemon startup. This merely
reduces memory consumption of the cache. Expired authentication tokens
were not used either way. ([#1337])
* Fixed a bug introduced in 0.15.0 where CAs do to not clear fulfilled
certification requests causing them to re-request a certificate every
time they contact their parent. ([#1345])
* Do not re-try syncing with a parent of a CA when that parent isn’t
known. ([#1349])
* Fixed un-suspending child CAs: rather then re-publishing the previously
revoked certificate, a new certificate is now issued. ([#1341])
Other changes
* The default config files don’t serve as config documentation any more.
Rather, there is now a `krill.conf.5` manual page. This manual page is
also included in the Krill manual. ([#1322])
* The cryptography library used by the rustls TLS implementation has been
switched to aws-lc-rs. This has some consequences for packaging:
* Dropped packaging for Ubuntu 20.04 (Focal Fossa). ([#1359])
This needs some changes as rpki-rs 0.19.2 mandated the use of signing
time and removed the use of binary signing time from RPKI certificates.
Krill did this already, anyway, so there are no functional changes, just
adjustments to changed APIs.
This PR fixes an issue a CA is unsuspending a child CA. Rather then
re-publishing the previously revoked certificate, a all new certificate is
now issued.
This PR fixes a bug introduced in 0.15.0 where CAs do to not clear
fulfilled certification requests causing them to re-request a
certificate every time they contact their parent.
This PR adds API access via a local Unix socket on Unix systems allowing to
use the username of local user accessing the API as the authentication
username.
Configuration options are provided to map user names to roles similar to the
configfile authentication provider.
This will allow using Krill without authentication tokens if it is only
accessed via krillc on the same machine.
The PR also removes the example configuration files and moves the
documentation included in those files into a krill.conf.5 manual page. By
doing this, it simplifies the creation of the configuation file in the binary
packages. Those are now very minimal and only contain the mandatory config
options.
This PR brings back the built-in tree of downloaded RISwhois data rather
than using the Roto API. It does so using a memory-optimized tree
implementation and has a much smaller memory footprint than the previous
iteration. At the time of writing, the a full RISwhois dataset requires 55
megabytes of memory.
This PR also reverts the changes to the configuration. It removes the
bgp_api_enabled, bgp_api_uri, and bgp_api_cache_duration fields and adds
bgp_riswhois_enabled, bgp_riswhois_v4_uri, bgp_riswhois_v6_uri, and
bgp_riswhois_refresh_duration fields, all of which are optional.
Because of these config changes, the PR is a breaking change.
This PR fixes an issue where removing children or parents from CAs fails
before a successful communication with the remote CA. It also fixes an error
message when CAs without parent, children, and repository are removed.
This PR resolves an issue with the new BGP API code which returns no
announcement info even though there is announcement info (but it is
available, but there is no information about its relations).
Martin Hoffmann