LoginSign Up
← Back to all sparks
R

Routinator

INFRA · APIS
Velocity0.0

RPKI relying party software validating BGP route origin authorisations

routinator.docs.nlnetlabs.nl ↗

An RPKI validator that now treats its own attack surface as the product

rpkisecurity-hardeningcve-responsenetwork-infrastructureoperator-ergonomics
◆Current state
Routinator is a mature RPKI relying-party validator shipping on a slow, deliberate cadence — a handful of releases a year, each one gated behind release candidates. The current 0.15.x line is dominated by hardening: 0.15.2 resolves four CVEs surfaced by an external X41 D-Sec audit funded by the Sovereign Tech Agency. Feature work has narrowed to operational ergonomics — RRDP timeout tuning, repository-issue log separation, and making server mode degrade gracefully instead of stalling.
◆Where it's heading
The arc is from feature-building to operator-trust engineering. Each recent release removes a way the validator can silently stop updating or be pushed into a panic: broken local exception files now warn instead of halting, transient connection errors no longer exit, and rsync argument handling is being locked down. Third-party audits are now part of the release process rather than an event.
◆Prediction
Expect the 0.15.x line to continue with small hardening patches rather than new capability, with any remaining audit findings landing as point releases.

◆Recent moves

  1. 4mo ago

    Security audit closes four CVEs in 0.15.2

    An external audit by X41 D-Sec produced four CVEs — a path-traversal in rsync URI handling, two panic conditions, and an XML parsing regression — all fixed here. This is the clearest expression of the trust-engineering turn: the release exists because someone was paid to attack the validator.

    View source ↗
  2. 1y ago

    0.15.1 stops empty-dataset starts and unblocks privileged ports

    Two operator-facing corrections: the optimistic initial run now aborts rather than succeeding with an empty data set, and a systemd PrivateUsers restriction is undone so Routinator can bind privileged ports. Both fit the pattern of removing quiet failure modes.

    View source ↗
  3. 1y ago

    0.15.0 reworks RRDP timeouts and separates repository-issue logs

    The substantive release of this line: a new rrdp-read-timeout config, repository-issue messages moved off the main log and behind an opt-in, and server mode changed to keep running on broken local exception files. It also permanently closes CVE-2023-39916 by removing the rrdp-keep-responses feature outright.

    View source ↗
  4. 1y ago

    0.15.0-rc1 preview of the RRDP timeout rework

    Release candidate whose changelog is a subset of the final 0.15.0 — same breaking changes, same timeout work. No independent signal.

    View source ↗
  5. 1y ago

    0.14.2 fixes bundled UI pointing at the wrong instance

    A single bundled-UI version bump correcting a build that read data from the vendor's own test instance. Narrow fix for users of the bundled UI only.

    View source ↗
  6. 1y ago

    0.14.2-rc1 bundles Routinator UI 0.4.5

    Release candidate carrying the same single UI bump that shipped as 0.14.2. Subset of the final release.

    View source ↗