feat(rpki): ripestat validator + sqlite cache

RipeStatValidator makes two RIPE STAT calls per uncached IP:
network-info -> announced prefix, rpki-validation -> ROA state.
2-second timeout; any network failure returns status='unknown'.

SQLite cache keyed by IP, 12-hour TTL, pruned on validator init.
Cache avoids per-event HTTP for the high-churn attacker pool —
steady-state cost approaches zero for repeat offenders.

tests/rpki/test_cache.py

@@ -0,0 +1,64 @@
+"""SQLite RPKI cache tests."""
+from __future__ import annotations
+
+import time
+from pathlib import Path
+
+import pytest
+
+from decnet.rpki.cache import TTL_S, get, open_db, prune, put
+
+
+@pytest.fixture()
+def db(tmp_path: Path):
+    return open_db(tmp_path / "rpki.db")
+
+
+def test_miss_returns_none(db) -> None:
+    assert get(db, "8.8.8.8") is None
+
+
+def test_put_then_get_returns_entry(db) -> None:
+    put(db, "8.8.8.8", 15169, "valid", "8.8.8.0/24")
+    result = get(db, "8.8.8.8")
+    assert result == ("valid", "8.8.8.0/24")
+
+
+def test_get_returns_none_prefix_when_stored_null(db) -> None:
+    put(db, "1.2.3.4", 64496, "not-found", None)
+    status, prefix = get(db, "1.2.3.4")
+    assert status == "not-found"
+    assert prefix is None
+
+
+def test_expired_entry_returns_none(db, monkeypatch: pytest.MonkeyPatch) -> None:
+    put(db, "8.8.8.8", 15169, "valid", "8.8.8.0/24")
+    future = time.time() + TTL_S + 1
+    monkeypatch.setattr("decnet.rpki.cache.time.time", lambda: future)
+    assert get(db, "8.8.8.8") is None
+
+
+def test_replace_updates_entry(db) -> None:
+    put(db, "8.8.8.8", 15169, "valid", "8.8.8.0/24")
+    put(db, "8.8.8.8", 15169, "invalid", "8.8.8.0/24")
+    status, _ = get(db, "8.8.8.8")
+    assert status == "invalid"
+
+
+def test_prune_removes_stale_rows(db, monkeypatch: pytest.MonkeyPatch) -> None:
+    put(db, "1.1.1.1", 13335, "valid", "1.1.1.0/24")
+    put(db, "2.2.2.2", 3215, "invalid", "2.0.0.0/8")
+    future = time.time() + TTL_S + 1
+    monkeypatch.setattr("decnet.rpki.cache.time.time", lambda: future)
+    count = prune(db)
+    assert count == 2
+    # After prune, both gone
+    assert get(db, "1.1.1.1") is None
+    assert get(db, "2.2.2.2") is None
+
+
+def test_prune_keeps_fresh_rows(db) -> None:
+    put(db, "8.8.8.8", 15169, "valid", "8.8.8.0/24")
+    count = prune(db)
+    assert count == 0
+    assert get(db, "8.8.8.8") is not None

tests/rpki/test_validator.py

@@ -0,0 +1,125 @@
+"""RipeStatValidator HTTP + cache integration tests.
+
+All network calls are intercepted via monkeypatching
+``urllib.request.urlopen`` so no real HTTP leaves the test runner.
+"""
+from __future__ import annotations
+
+import io
+import json
+from pathlib import Path
+from typing import Any
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+
+def _mock_urlopen(responses: dict[str, Any]):
+    """Return a context-manager mock for urlopen that dispatches by URL fragment."""
+
+    def _urlopen(req, timeout=None):
+        url = req.full_url if hasattr(req, "full_url") else str(req)
+        for fragment, payload in responses.items():
+            if fragment in url:
+                body = json.dumps(payload).encode()
+                mock = MagicMock()
+                mock.__enter__ = lambda s: io.BytesIO(body)
+                mock.__exit__ = MagicMock(return_value=False)
+                return mock
+        raise ValueError(f"Unexpected URL in test: {url}")
+
+    return _urlopen
+
+
+_NETWORK_INFO_VALID = {
+    "data": {"prefix": "8.8.8.0/24", "asns": ["15169"]}
+}
+_RPKI_VALID = {
+    "data": {"status": "valid", "validating_roas": []}
+}
+_RPKI_INVALID = {
+    "data": {"status": "invalid", "validating_roas": []}
+}
+_RPKI_NOT_FOUND = {
+    "data": {"status": "not-found", "validating_roas": []}
+}
+_NETWORK_INFO_EMPTY = {"data": {"prefix": None}}
+
+
+@pytest.fixture()
+def validator(tmp_path: Path, monkeypatch: pytest.MonkeyPatch):
+    monkeypatch.setenv("DECNET_RPKI_ROOT", str(tmp_path))
+    # Re-import to pick up the patched root
+    import importlib
+    import decnet.rpki.paths as rpki_paths
+    monkeypatch.setattr(rpki_paths, "RPKI_ROOT", tmp_path)
+
+    from decnet.rpki.ripestat.validator import RipeStatValidator
+    return RipeStatValidator()
+
+
+def test_valid_result(validator) -> None:
+    responses = {
+        "network-info": _NETWORK_INFO_VALID,
+        "rpki-validation": _RPKI_VALID,
+    }
+    with patch("urllib.request.urlopen", side_effect=_mock_urlopen(responses)):
+        result = validator.validate("8.8.8.8", 15169)
+    assert result.status == "valid"
+    assert result.prefix == "8.8.8.0/24"
+
+
+def test_invalid_result(validator) -> None:
+    responses = {
+        "network-info": _NETWORK_INFO_VALID,
+        "rpki-validation": _RPKI_INVALID,
+    }
+    with patch("urllib.request.urlopen", side_effect=_mock_urlopen(responses)):
+        result = validator.validate("8.8.8.8", 64496)
+    assert result.status == "invalid"
+
+
+def test_not_found_when_no_prefix(validator) -> None:
+    responses = {"network-info": _NETWORK_INFO_EMPTY}
+    with patch("urllib.request.urlopen", side_effect=_mock_urlopen(responses)):
+        result = validator.validate("192.0.2.1", 64496)
+    assert result.status == "not-found"
+
+
+def test_unknown_on_network_error(validator) -> None:
+    with patch("urllib.request.urlopen", side_effect=OSError("timeout")):
+        result = validator.validate("8.8.8.8", 15169)
+    assert result.status == "unknown"
+
+
+def test_cache_hit_skips_http(validator) -> None:
+    responses = {
+        "network-info": _NETWORK_INFO_VALID,
+        "rpki-validation": _RPKI_VALID,
+    }
+    with patch("urllib.request.urlopen", side_effect=_mock_urlopen(responses)) as mock:
+        validator.validate("8.8.8.8", 15169)
+        validator.validate("8.8.8.8", 15169)  # second call — should hit cache
+    # urlopen called exactly twice (once per endpoint on the first call)
+    assert mock.call_count == 2
+
+
+def test_rpki_not_found_status_stored(validator) -> None:
+    responses = {
+        "network-info": _NETWORK_INFO_VALID,
+        "rpki-validation": _RPKI_NOT_FOUND,
+    }
+    with patch("urllib.request.urlopen", side_effect=_mock_urlopen(responses)):
+        result = validator.validate("8.8.8.8", 99999)
+    assert result.status == "not-found"
+
+
+def test_unknown_status_normalised(validator) -> None:
+    """Any unrecognised status string from RIPE STAT collapses to 'unknown'."""
+    responses = {
+        "network-info": _NETWORK_INFO_VALID,
+        "rpki-validation": {"data": {"status": "something-new"}},
+    }
+    with patch("urllib.request.urlopen", side_effect=_mock_urlopen(responses)):
+        result = validator.validate("8.8.8.8", 15169)
+    assert result.status == "unknown"