lolepezy / rpki-prover Goto Github PK

View Code? Open in Web Editor NEW

10.0 6.0 6.0 12.69 MB

Yet another RPKI validator

License: BSD 3-Clause "New" or "Revised" License

Haskell 99.37% Shell 0.35% CSS 0.29%

rpki rtr roa docker-image rsync cryptography routing-security

rpki-prover's People

Contributors

Stargazers

Watchers

Forkers

dadepo iamthatiam777 wibisono sitedata acidburn0zzz sherfeyinv

rpki-prover's Issues

Add support for GBRs

https://tools.ietf.org/html/rfc6493

Implement the concept of the "failed fetch"

See https://tools.ietf.org/html/draft-ietf-sidrops-6486bis-03#section-6.7

Current implementation doesn't care about the fetch on which certain object was downloaded.
So if newly downloaded MFT is broken, next top-down validation will try to use it again, instead
of trying to use the previous valid version.

We need some concept of "roll-back to previous version of the MFT" to avoid dropping the whole
bunch of VRPs at once.

Use proper User-Agent when downloading RRDP files

rpki-prover-$git-SHA?
Or rpki-prover-$git-revision-date?
Or rpki-prover-$version?

Investigate the idea of runnning RRDP update in a separate process

It can be very impractical and complex but may be a decent security feature.

Removing old long-unused objects may lead to broken MFT in `lastValidMft`

If a manifest mentioned in lastValidMft is not used for long time, it will be removed. Also objects that it refers to may be cleaned up, so it will not be valid anymore.

Sort VRPs

Apparently, it's an important thing
NLnetLabs/routinator#461

Fix all the cases where the number of VRPs is wrong

There's still some small difference in the number of VRPs compared to routinator and rpki-client.
Figure out why is it there and fix it.

Replace Options.Generic with something simpler

Options.Generic uses type-level descriptions and it's not possible to lift default values to type level. Replace it with something more classical like optparse-applicative, using term level only.

Remove servant-cassava and generate CSV by hands

It's way too slow and servant-cassava is not properly maintained.

Add validation of the filenames in the MFT entries

https://tools.ietf.org/html/draft-ietf-sidrops-6486bis-03#section-4.2.2

Add router certificate support

Handle IPv6/IPv4 fallbacks

Example: https://rpki.caramelfox.net/rrdp/notification.xml doesn't respond to a connection using IPV6 address, but DNS returns IPv6 as the first one. As a result connection times out and we fall back to rsync. Http client should use "happy eyeballs DNS" or something similar to handle this case.

Error occurs while compiling

Hello,

i wanted to update my instance of rpki-prover to the latest changes in this repository. I used the same environment as one month before, but a failure occurs. Should I use a completely new installation for the compilation? Does the last compilation affect this new compilation?

Here's the error output of stack:

[59 of 60] Compiling RPKI.TopDown
/home/ubuntu/rpki-prover/src/RPKI/TopDown.hs:63:1: error:
    Could not find module ‘RPKI.Fetch’
    Use -v (or `:set -v` in ghci) to see a list of the files searched for.
   |
63 | import           RPKI.Fetch
   | ^^^^^^^^^^^^^^^^^^^^^^^^^^^


Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/AppContext.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/AppMonad.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/AppState.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/CommonTypes.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Config.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Domain.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Http/Api.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Http/HttpServer.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Http/Messages.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Http/Types.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Http/UI.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Logging.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Metrics.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Orphans/Generics.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Orphans/Serialise.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Parallel.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Parse/Internal/Cert.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Parse/Internal/Common.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Parse/Internal/CRL.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Parse/Internal/GBR.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Parse/Internal/MFT.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Parse/Internal/ROA.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Parse/Internal/SignedObject.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Parse/Parse.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Reporting.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Repository.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Resources/IntervalSet.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Resources/Resources.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Resources/Types.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/RRDP/Http.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/RRDP/Parse.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/RRDP/RrdpFetch.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/RRDP/Types.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Rsync.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/RTR/Pdus.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/RTR/RtrServer.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/RTR/RtrState.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/RTR/Types.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Store/AppLmdbStorage.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Store/AppStorage.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Store/Base/InMemory.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Store/Base/LMDB.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Store/Base/Map.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Store/Base/MultiMap.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Store/Base/Storable.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Store/Base/Storage.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Store/Database.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Store/MakeInMemory.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Store/MakeLmdb.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Store/Repository.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Store/Sequence.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/TAL.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Time.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Util.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Validation/Crypto.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Validation/ObjectValidation.hi Decoding failure: Invalid magic: e49ceb0f

Warning: Failed to decode module interface: /home/ubuntu/rpki-prover/.stack-work/dist/aarch64-linux/Cabal-3.2.1.0/build/RPKI/Validation/ResourceValidation.hi Decoding failure: Invalid magic: e49ceb0f
Completed 208 action(s).

--  While building package rpki-prover-0.1.0.0 using:
      /home/ubuntu/.stack/setup-exe-cache/aarch64-linux/Cabal-simple_mPHDZzAJ_3.2.1.0_ghc-8.10.4 --builddir=.stack-work/dist/aarch64-linux/Cabal-3.2.1.0 build lib:rpki-prover exe:rpki-prover --ghc-options " -fdiagnostics-color=always"
    Process exited with code: ExitFailure 1

Fix all `resourceGroup` tests

Some tests in RPKI.ResourcesSpec are still failing sometimes.

Implement the latest 6486bis whatever it becomes

At the moment it is still a little big of a moving target
https://tools.ietf.org/html/draft-ietf-sidrops-6486bis-03

Strict MFTs, 'failed fetch' concept, etc.

Create packages with systemd support

Create Deb and RPM (using static binary?)

Calculate LMDB size based on other parameters

Currently it is 8gb, which but can be too small for certain cache lifetimes. Figure out some simple heuristics that would allow to calculate it?

Create a Docker image

Segfault in LMDB

Messages like (on Linux)
rpki-prover:w[2193433]: segfault at 179 ip 00007f9c8878602d sp 00007f9b48ff4db0 error 4 in liblmdb.so.0.0.0[7f9c88783000+10000]

The same happens on macos.

It can be reproduced by sending an async exception to a thread running RO lmdb transaction. Doesn't happen every time, but happens pretty reliably. Workaround -- do not cancel asyncs running transactions. It probably need to be fixed in the lmdb-high-level library.

Use co-log-concurrent

Currently logging happens with MVar locking, which is not a very scalable option.
A more efficient thing would be to use co-log-concurrent (e.g. https://gist.github.com/qnikst/f38bbaee033aaa3df8a9d115c951182a).

Implement RRDP -> rsync fall-back

Maybe as a CLI option?

Generally, it would be beneficial to have

fetchURI uri1 <|> ... fetchURI uriN logic regardless of which one is RRDP and which one is rsync to support all potential extensions of the RFCs, multi-URL repositories or whatever comes up over time.

Prefer HTTPS over rsync when fetching the certificate in the TAL

Most (all?) TALs contain two URIs. Currently, if the first URI is HTTPS, and the second is rsync, it will try the rsync one.
RFC 8630 recommends preferring the HTTPS URI over the rsync one if both are present:
https://datatracker.ietf.org/doc/html/rfc8630#section-4

Fix "reference cycle"

If an object is referenced multiple times it will be marked as creating "reference cycle" which is not necessary true. Reference cycles can only happen between certificates and manifests.

Add some reasonable UI

It can be ugly, but compact and informative.

Add prometheus metrics

Metrics that are currently exposed with "/api/metrics" should (also) be exposed as prometheus metrics.

See, http://hackage.haskell.org/packages/search?terms=prometheus
and ask around which library doesn't suck nowadays.

Introduce DB versioning

It should understand that the data in cache cannot be deserialised by an updated version. In this case it should automatically wipe the whole DB (or just the relevant part?), complain about it in the log, re-dowload repositories and continue instead of complaining about weird deserialisation errors.

Associate objects with repositories where they came from

I will allow to safely do "withdraw" by checking is the withdrawing repository is the same as published the object.
It will help to

reduce the cache size
quickly get rid of "multiple locations" warning.

Setup a release procedure

Generate Linux static binary and push docker image to dockerhub for every 'releases/x.x.x' tag.

Support ETag in RRDP

Don't re-download notification.xml in case ETag says that it's not needed.

Remove ' [<unknown loc>]' from the log

RRDP parser says "RrdpE NoSessionId" for completely messed up content

RFC insists on validating that XML corresponds to the schema. So error message should be more predictable and say that the whole file is not what RRDP parser expects at all.

Fix the 'invalid cursor' problem

That happens after copying the data to a new environment, i.e. using
RPKI.Store.AppStorage.defragmentStorageWithTmpDir. New environment is

successfully created
filled in with data
old env is closed
new one is re-opened
new one is unusable (with LMDB code 22)

After restarting the process the new environment is perfectly usable.

It probably has to do with some LMDB quirks when one has more than one environment in one process.

Once in a while local rsync copies need to be cleaned up

Since "rsync --delete" is not used, there's potential for these copies to grow indefinitely.
Clean them up every few days/weeks.

Replace `streaming-utils` and `json-stream` with something more alive.

These libraries are used in RPKI.RRDP.Http.
They are present in the Stackage 16.27 LTS, but not in nightly and are not updated for long time.
Since we don't really care how to stream-download files, just replace it with http-conduit or pipes, ]
or anything that is better supported.

Test/benchmark different serialisation libraries

Current implementation uses serialise and it's pretty not bad. The hot-spot in profiling is deserialising objects read from LMDB, so it's better to chose a library that does it with least CPU time necessary.

try store instead of serialise and benchmark
try TH instead of Generic deriving and benchmark

ROAs with revoked certificate on the manifest are considered invalid

That happens for ROAs coming from rpki.cnnic.cn that by some reason includes them on the manifest.
Read https://tools.ietf.org/html/draft-ietf-sidrops-6486bis-03 carefully once again and decide if it's a bug
or should be done this way.

GC-ing unused objects can lead to invalid repositories

In the following scenario things can go really wrong.

A RRDP repository publishes a ROA and a manifest that doesn't refer to the ROA.
After time defined by --cache-lifetime the ROA is GC-ed, because it was never touched by a top-down validation.
After that the repository publishes a new manifest that now refers to the ROA
Top-down validation considers the manifest and the CA invalid, since it has a dangling reference.
Earth collapses to a black hole.

While in practice this scenario doesn't make any sense, it is still technically valid behaviour of a RRDP repository and must be taken into consideration.

Properly compare signature algorithms in different parts of CMSs

Current implementation using hs-certificate has exactly the same problem of interpreting signature algorithm without parameters and with NULL as equal.

See
http://sobornost.net/~job/arin-manifest-issue-2020.08.12.txt,
https://www.arin.net/announcements/20200812/.

This needs modifying hs-certificate or implementing another custom parser for signature algorithm.

Ctrl+C doesn't always stop the process

Implement proper signal handling so that the process reliably stops. Review exception propagation in concurrent/parallel code. That is required for systemd integration.

Build static Linux binaries

Fix memory issue on Linux, reduce RSS

RSS of the process on Linux looks like it indefinitely(?) growing and it's hard to say why.
Haskell heap seems to be perfectly fine, but the total RSS grows over time.

That does not seem to happen on MacOS, so there's a chance that it's some sort of misinterpretation.

Improve the case of multiple TAs referring the same repository

https://rpki.admin.freerangecloud.com/rrdp/notification.xml
is fetched 3 times, once for each TA.

Sharing TVar PublicationPoints between TA threads leads to weird race,
use something better.

Document requirement for rsync

For installations that don't have rsync, rpki-prover builds and starts fine, but will not function. This error will be seen in the output

[Error]   [21 Apr 2021 15:33:59.193 +00:00] [<unknown loc>] [ThreadId 11] Something weird happened rsync: startProcess: runInteractiveProcess: exec: does not exist (No such file or directory), exiting.

Recommendation: document requirement in README.md. Probably obvious; opening this issue in case others search for this error.

Add CRL location check

https://tools.ietf.org/html/draft-ietf-sidrops-6486bis-03#section-6.1
A manifest SHOULD contain exactly one CRL (.crl) file and it MUST be at the location specified in the CRLDP in the manifest's EE certificate.

Add proper log levels and review logging

Add --log-level parameter with WARN, INFO (default), DEBUG levels.

validateRoa is not finished

It needs to check that the prefix on ROA is covered by the resource set on the EE certificate.

Add validation result history with search

Decouple VRP history from validation result history -- it doesn't make so much sense to store 100 versions of VRPs
Add API calls to search through validation result history, there's an obvious use case for it "figure out if and when a problem with this URL/prefix/hash happened"
Add some UI for it

Store all locations for every object

There are still TODOs to fix that: an object (defined by hash) can have multiple locations but only one is stored. It would be very useful to store them all to see duplication.

Does mkdirs.sh require an arguement?

Should the script mkdirs.sh be run with an argument?

#!/bin/sh

ROOT=$1

mkdir -p ${ROOT}/cache
...

run without an argument, the script tries to make directories in /

Implement SLURM support

This needs to be implemented https://tools.ietf.org/html/rfc8416.

Applied assertions and BGP filters the VRPs of the validateTA function so that the results gets into RTR server.