T7432: RPKI VRF Support

[yzguy]

Change summary

Add support for RPKI in a VRF

TODO:

Need to add to documentation

Op-mode commands

show rpki as-number <asn>  vrf <vrf>
show rpki cache-connection vrf <vrf>
show rpki cache-server vrf <vrf>
show rpki prefix <prefix> vrf <vrf>
show rpki prefix <prefix> as-number <asn> vrf <vrf>
show rpki prefix-table vrf <vrf>
reset rpki vrf <vrf>

Configuration Commands

set vrf name <name> protocols rpki cache <cache> port <port>
set vrf name <name> protocols rpki cache <cache> preference <pref>
set vrf name <name> protocols rpki cache <cache> source-address <src>
set vrf name <name> protocols rpki cache <cache> ssh username <username>
set vrf name <name> protocols rpki cache <cache> ssh key <key>
set vrf name <name> protocols rpki polling-period <rolling-period>
set vrf name <name> protocols rpki retry-interval <retry-interval>

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Code style update (formatting, renaming)
• Refactoring (no functional changes)
• Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
• Other (please describe):

Related Task(s)

https://vyos.dev/T7432

Related PR(s)

How to test / Smoketest result

Checklist:

• I have read the CONTRIBUTING document
• I have linked this PR to one or more Phabricator Task(s)
• I have run the components SMOKETESTS if applicable
• My commit headlines contain a valid Task id
• My change requires a change to the documentation
• I have updated the documentation accordingly

[github-actions]

👍
No issues in PR Title / Commit Title

[c-po]

You do not set a VRF table id in your smoketests which makes them fail:

======================================================================
ERROR: test_rpki_ssh (__main__.TestProtocolsRPKI.test_rpki_ssh)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/usr/libexec/vyos/tests/smoke/cli/test_protocols_rpki.py", line 211, in test_rpki_ssh
    self.cli_commit()
  File "/usr/libexec/vyos/tests/smoke/cli/base_vyostest_shim.py", line 103, in cli_commit
    out = self._session.commit()
          ^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/vyos/configsession.py", line 280, in commit
    out = self.__run_command([COMMIT])
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/vyos/configsession.py", line 210, in __run_command
    raise ConfigSessionError(output)
vyos.configsession.ConfigSessionError: [ vrf ]
VRF "blue" table id is mandatory!
[[vrf]] failed
[ pki ]
Embedded PKI openssh with name "rpki-smoketest" is still in use by CLI
path "protocols rpki cache 192.0.2.3 ssh key"
[[pki]] failed
[[vrf name blue protocols rpki]] failed
Commit failed

[c-po]

The proposed CLI op-mode commands differ from other VRF enabled implementations:

[c-po]

The general implementation looks good and follows established patterns for FRR.

Smoketests still fail:

[email protected]:~$ /usr/libexec/vyos/tests/smoke/cli/test_protocols_rpki.py
test_rpki (__main__.TestProtocolsRPKI.test_rpki) ... ok
test_rpki_source_address (__main__.TestProtocolsRPKI.test_rpki_source_address) ... ok
test_rpki_ssh (__main__.TestProtocolsRPKI.test_rpki_ssh) ... ERROR
test_rpki_verify_preference (__main__.TestProtocolsRPKI.test_rpki_verify_preference) ... ok

======================================================================
ERROR: test_rpki_ssh (__main__.TestProtocolsRPKI.test_rpki_ssh)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/usr/libexec/vyos/tests/smoke/cli/test_protocols_rpki.py", line 217, in test_rpki_ssh
    self.cli_commit()
  File "/usr/libexec/vyos/tests/smoke/cli/base_vyostest_shim.py", line 103, in cli_commit
    out = self._session.commit()
          ^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/vyos/configsession.py", line 280, in commit
    out = self.__run_command([COMMIT])
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/vyos/configsession.py", line 210, in __run_command
    raise ConfigSessionError(output)
vyos.configsession.ConfigSessionError: [ pki ]
Embedded PKI openssh with name "rpki-smoketest" is still in use by CLI
path "protocols rpki cache 192.0.2.3 ssh key"
[[pki]] failed
[ vrf name blue protocols rpki ]
RPKI+SSH requires key to be defined!
[[vrf name blue protocols rpki]] failed
Commit failed


----------------------------------------------------------------------
Ran 4 tests in 65.914s

FAILED (errors=1)

[github-actions]

CI integration 👍 passed!

Details

CI logs

• CLI Smoketests (no interfaces) 👍 passed
• CLI Smoketests (interfaces only) 👍 passed
• Config tests 👍 passed
• RAID1 tests 👍 passed
• TPM tests 👍 passed

[c-po]

New feature additiona vailable with FRR10.2 - implementation follows established paths for FRR