LoginSign Up
← Back to all sparks
R

Routinator

INFRA · APIS
Velocity5.0

RPKI relying party software validating BGP route origin authorisations

routinator.docs.nlnetlabs.nl ↗

Routinator 0.16 now validates ASPA and BGPsec, and runs strict, by default

rpkiaspabgp-securitynetwork-infrastructurebreaking-changes
◆Current state
Routinator is a mature RPKI validator with a slow, release-candidate-gated cadence. 0.16.0 shipped on 6 November with the candidate's defaults: ASPA and BGPsec on, strict validation on, the old flags replaced by --disable-aspa, --disable-bgpsec and --relaxed, plus RSC (RFC 9323), SLURM v2 and a new repository logging scheme that changes the /status JSON. Three days later 0.16.1 fixed a crash on start when TLS is enabled for the HTTP or RTR servers.
◆Where it's heading
After a year of security fixes, Routinator has moved route-origin hardening from opt-in to default, which shifts the work onto operators who must now opt out. The quick 0.16.1 suggests the new release is meeting more varied deployments than the candidate did.
◆Prediction
Further 0.16.x fixes as operators upgrade into the new defaults are the likely next releases; nothing in the entries points to new features soon.

◆Recent moves

  1. 4d ago

    0.16.1 fixes a crash on start with TLS enabled

    A one-fix release three days after 0.16.0, for a crash on start when TLS is on for the HTTP or RTR servers. Only TLS-enabled deployments were affected, but it blocked them from upgrading.

    View source ↗
  2. 8d ago

    0.16.0 turns on ASPA, BGPsec and strict validation by default

    The final release confirms the candidate's breaking defaults with ASPA, BGPsec and strict mode on, and adds RSC and SLURM v2 with ASPA filtering. Operators upgrading need to check flags and anything that parses /status.

    View source ↗
  3. 15d ago

    Routinator 0.16.0-rc1: ASPA, BGPsec and strict mode on by default

    The 0.16 candidate turns on ASPA, BGPsec and strict validation by default and adds RSC and SLURM v2 support, with flag and /status changes operators must handle. A default shift after a year spent on hardening; still a release candidate.

    View source ↗
  4. 18d ago

    Routinator 0.15.3 fixes resource-exhaustion paths

    Routinator 0.15.3 fixes several resource-exhaustion paths, including CRL re-decoding, whole-set buffering of output and recursive drops. Worth deploying for RPKI validators exposed to hostile repositories.

    View source ↗
  5. 5mo ago

    Security audit closes four CVEs in 0.15.2

    An external audit by X41 D-Sec produced four CVEs — a path-traversal in rsync URI handling, two panic conditions, and an XML parsing regression — all fixed here. This is the clearest expression of the trust-engineering turn: the release exists because someone was paid to attack the validator.

    View source ↗
  6. 1y ago

    0.15.1 stops empty-dataset starts and unblocks privileged ports

    Two operator-facing corrections: the optimistic initial run now aborts rather than succeeding with an empty data set, and a systemd PrivateUsers restriction is undone so Routinator can bind privileged ports. Both fit the pattern of removing quiet failure modes.

    View source ↗