NLnet Labs Routinator

NLnet Labs Routinator
Name	Routinator
Developer	NLnet Labs
Released	2016
Programming language	Rust
Operating system	Unix-like
License	BSD-2-Clause

NLnet Labs Routinator

Routinator is an open-source RPKI relying party implementation originating from NLnet Labs, designed to validate Route Origin Authorizations for the Border Gateway Protocol and integrate with network routing of Internet exchange points and content delivery networks. It interoperates with Resource Public Key Infrastructure repositories and certificate authorities used by regional Internet registries such as ARIN, RIPE NCC, APNIC, AFRINIC and LACNIC, and is intended for operators of Internet routing fabric, IXPs, tier 1 carriers and cloud providers. The project emphasizes correctness, automation, compliance with IETF standards and integration with routing daemons and monitoring systems.

Introduction

Routinator implements RPKI validation for RIR-sourced number registries and interacts with Route Origin Authorizations, manifests, Certificate Authority repositories, and RPKI publication points to produce validated ROA lists consumed by routers and routing suites. The software follows specifications from the IETF RPKI working group and related RFCs, aligning behavior with implementations such as RIPE NCC validators, cloud provider validators, and network operator toolchains. As an NLnet Labs project, Routinator is part of a family that includes name server and DNSSEC tooling and is frequently discussed alongside routing projects used at IXPs, content distribution networks, and enterprise backbone networks.

History and Development

Development began at NLnet Labs in response to operational needs articulated by Internet registries and network operators after early RPKI pilots involving ARIN and RIPE NCC; early adopters included researchers and operators at organizations like ISOC and the Internet Architecture Board. The project evolved through contributions from Rust language advocates, open-source foundations, and engineers from hardware vendors and software firms who participated in IETF meetings and MANRS community forums. Release milestones followed RFC updates and protocol extensions promoted by working groups and standards bodies, with test suites influenced by laboratory work at academic institutions and interoperability events run by network operator groups and exchange point consortia.

Architecture and Features

Routinator is written in Rust and uses asynchronous IO and efficient parsers to fetch RPKI objects from RSYNC, HTTPS, and rsync-over-SSH repositories published by RIRs and delegated Certificate Authorities. The architecture separates object fetch, certificate validation, VRP (Validated ROA Payload) computation, and RPKI-to-Router distribution, enabling integration with routing daemons such as FRRouting, Bird, OpenBGPD, and vendor platforms from Cisco, Juniper, and Arista. Features include RFC-compliant CMS parsing, CRL handling consistent with CA/Browser Forum expectations, repository caching, ROA origin and MaxLength handling, RTR protocol server support for routers and route collectors, and JSON/status interfaces suited to monitoring stacks like Prometheus, Grafana, and ELK deployments.

Deployment and Configuration

Operators deploy Routinator on Unix-like hosts in environments ranging from single-server validators to distributed validator clusters integrated with peering fabric at IXPs and content delivery infrastructures. Configuration supports automated repository discovery via rsync and RRDP, X.509 trust anchors distributed by RIRs, and policy controls used by network operations centers, traffic engineering teams, and peering coordinators. Deployment patterns include standalone validators feeding RTR sessions to edge routers, validator clusters behind load balancers for redundancy used by transit providers, and containerized instances orchestrated by Kubernetes clusters managed by operators of cloud platforms and CDN infrastructures.

Security and Performance

Security considerations for Routinator cover cryptographic validation of X.509 resource certificates, strict CMS signature verification, timely CRL and manifest processing, and hardening against repository poisoning attacks observed in operational incidents involving publication point misconfigurations. Performance optimizations include incremental repository updates, parallel fetch pipelines influenced by software used in high-performance networking labs, and memory safety benefits from Rust that reduce class of vulnerabilities compared to counterparts written in memory-unsafe languages. Operational security practices integrate with incident response playbooks maintained by national CERT teams, peering communities, and carrier security operations centers.

Adoption and Use Cases

Adopters include Internet service providers, content delivery networks, cloud operators, research networks, university backbone operators, and exchange points that require origin validation to protect BGP routing tables and implement route filtering policies originating from MANRS recommendations and regional registry directives. Use cases span prevention of route hijacks affecting enterprise VPNs, validation for transit provider route servers, prefix filtering at IXPs, and forensic analysis by network researchers and incident response units using validated ROA datasets. Routinator often appears in toolchains alongside route collectors, BGPmon, MRT archives, and network observability platforms used by operators and researchers.

License and Governance

Routinator is distributed under a permissive BSD-style license and governed by NLnet Labs, which maintains the codebase, issue trackers, and release management; contributions come from independent developers, operator-sponsored engineers, and volunteers coordinated through issue trackers and code review workflows influenced by open-source foundations and working groups. Governance practices align with community norms established by foundation-hosted projects and follow guidelines used by organizations engaging in open network standards, with security disclosure and contribution policies to coordinate responses with registry operators and standards bodies.

Category:Routing software Category:Internet Standards Category:Open-source software