From: Alberto Leiva Popper Date: Thu, 16 Jul 2026 01:50:19 +0000 (-0600) Subject: Protocolary updates for release 1.7.0.experimental X-Git-Tag: 1.7.0.experimental^0 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c67d14bcdbc8cbcf100e97c481a8c4ef6eb0ca7e;p=thirdparty%2FFORT-validator.git Protocolary updates for release 1.7.0.experimental --- diff --git a/configure.ac b/configure.ac index ac9ac044..798bc880 100644 --- a/configure.ac +++ b/configure.ac @@ -2,7 +2,7 @@ # Process this file with autoconf to produce a configure script. AC_PREREQ([2.69]) -AC_INIT([fort],[1.6.8],[validadorfort@fortproject.net]) +AC_INIT([fort],[1.7.0.experimental],[validadorfort@fortproject.net]) AC_CONFIG_SRCDIR([src/main.c]) AM_INIT_AUTOMAKE([subdir-objects]) diff --git a/docker/Dockerfile b/docker/Dockerfile index 96e45917..2a6540ee 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -1,6 +1,6 @@ #--- Alpine build container --- FROM alpine:latest AS builder -ARG FORT_VERSION=1.6.8 +ARG FORT_VERSION=1.7.0.experimental # Install compiler and dependencies RUN apk --update --no-cache add build-base autoconf automake pkgconfig jansson-dev check-dev \ diff --git a/docs/_config.yml b/docs/_config.yml index 77e9e0c1..fde557f7 100644 --- a/docs/_config.yml +++ b/docs/_config.yml @@ -8,7 +8,7 @@ defaults: layout: "default" image: "/img/logo_validador_og.png" -fort-latest-version: 1.6.8 +fort-latest-version: 1.7.0.experimental plugins: - jekyll-seo-tag - jekyll-sitemap diff --git a/docs/intro-fort.md b/docs/intro-fort.md index fe4ccc72..2f9b76e0 100644 --- a/docs/intro-fort.md +++ b/docs/intro-fort.md @@ -20,26 +20,26 @@ Fort is a command-line application intended for UNIX operating systems, written | Issue | Title | Urgency | Due release | |-------|-------|---------|-------------| | [issue82](https://github.com/NICMx/FORT-validator/issues/82) | Reach 100% RFC 9286 compliance | Critical | 2.0.0 | +| [issue119](https://github.com/NICMx/FORT-validator/issues/119) | Review IRIs to file names transition | High | 2.0.0 | +| [issue121](https://github.com/NICMx/FORT-validator/issues/121) | Refactor validation and operation logging | High | 2.0.0 | | [issue149](https://github.com/NICMx/FORT-validator/issues/149) | Lock the cache during updates | High | 2.0.0 | +| [issue97](https://github.com/NICMx/FORT-validator/issues/97) | Add "incidence" fields for every nonfatal RFC incompliance | Medium | 2.0.0 | | [issue113](https://github.com/NICMx/FORT-validator/issues/113) | Detect and properly respond to subtler RRDP session desynchronization | Medium | 2.0.0 | | [issue124](https://github.com/NICMx/FORT-validator/issues/124) | Atomize output files (`--output.roa` and `--output.bgpsec`) | Medium | 2.0.0 | +| [issue126](https://github.com/NICMx/FORT-validator/issues/126) | Exhaustive URL validation | Medium | 2.0.0 | | [issue129](https://github.com/NICMx/FORT-validator/issues/129) | Rethink the thread pools | Medium | 2.0.0 | +| [issue131](https://github.com/NICMx/FORT-validator/issues/131) | Remove the Ghostbusters code | Low | 2.0.0 | | [issue114](https://github.com/NICMx/FORT-validator/issues/114) | Support automatic TA key rollover | Very High | 2.0.1 | | [issue58](https://github.com/NICMx/FORT-validator/issues/58) | Fort's validation produces no router keys | Very High | 2.0.2 | -| [issue132](https://github.com/NICMx/FORT-validator/issues/132) | Implement RTRv2 | Very High | - | | [issue116](https://github.com/NICMx/FORT-validator/issues/116) | SLURM review | High | - | -| [issue118](https://github.com/NICMx/FORT-validator/issues/118) | Implement validation re-reconsidered | High | - | -| [issue119](https://github.com/NICMx/FORT-validator/issues/119) | Review IRIs to file names transition | High | - | | [issue120](https://github.com/NICMx/FORT-validator/issues/120) | Error messages review | High | - | -| [issue121](https://github.com/NICMx/FORT-validator/issues/121) | Refactor validation and operation logging | High | - | | [issue72](https://github.com/NICMx/FORT-validator/issues/72) | Encrypt RTR | Medium | - | | [issue73](https://github.com/NICMx/FORT-validator/issues/73) | Minimize probability of RTR session ID and serial reuse | Medium | - | | [issue90](https://github.com/NICMx/FORT-validator/issues/90) | Add "metadata" section to json output | Medium | - | | [issue91](https://github.com/NICMx/FORT-validator/issues/91) | Add "ta" field to ROAs in json output | Medium | - | -| [issue97](https://github.com/NICMx/FORT-validator/issues/97) | Add "incidence" fields for every nonfatal RFC incompliance | Medium | - | | [issue117](https://github.com/NICMx/FORT-validator/issues/117) | Warn on maxLength defined on SLURM | Medium | - | +| [issue118](https://github.com/NICMx/FORT-validator/issues/118) | Implement validation re-reconsidered | Medium | - | | [issue125](https://github.com/NICMx/FORT-validator/issues/125) | ASN.1 review | Medium | - | -| [issue126](https://github.com/NICMx/FORT-validator/issues/126) | Exhaustive URL validation | Medium | - | | [issue127](https://github.com/NICMx/FORT-validator/issues/127) | Stream RRDP files | Medium | - | | [issue128](https://github.com/NICMx/FORT-validator/issues/128) | Reuse TCP connections for HTTP requests to same server | Medium | - | | [issue130](https://github.com/NICMx/FORT-validator/issues/130) | Improve documentation | Medium | - | @@ -47,8 +47,5 @@ Fort is a command-line application intended for UNIX operating systems, written | [issue152](https://github.com/NICMx/FORT-validator/issues/152) | compliance issue: Fort accepts GeneralizedTime with fractional seconds | Medium | - | | [issue153](https://github.com/NICMx/FORT-validator/issues/153) | Not enforcing DER encoding | Medium | - | | [issue40](https://github.com/NICMx/FORT-validator/issues/40) | failure scenarios, monitoring and glibc recommendations | Low | - | -| [issue42](https://github.com/NICMx/FORT-validator/issues/42) | reload feature: restart validation on SIGHUP | Low | - | -| [issue70](https://github.com/NICMx/FORT-validator/issues/70) | Do a quick temporary offline validation to prevent `No Data Available` | Low | - | | [issue123](https://github.com/NICMx/FORT-validator/issues/123) | New invocation mode: Validate single file | Low | - | -| [issue131](https://github.com/NICMx/FORT-validator/issues/131) | Implement vCard validation | Low | - | | [issue134](https://github.com/NICMx/FORT-validator/issues/134) | Add support RFC 9589 (On the Use of the CMS Signing-Time Attribute in RPKI Signed Objects) | Low | - | diff --git a/docs/usage.md b/docs/usage.md index 9899ce74..6e2d4ac5 100644 --- a/docs/usage.md +++ b/docs/usage.md @@ -29,6 +29,7 @@ description: Guide to use arguments of FORT Validator. 17. [`--server.interval.retry`](#--serverintervalretry) 18. [`--server.interval.expire`](#--serverintervalexpire) 18. [`--server.deltas.lifetime`](#--serverdeltaslifetime) + 18. [`--server.max-rtr-version`](#--servermax-rtr-version) 18. [`--prometheus.port`](#--prometheusport) 19. [`--slurm`](#--slurm) 20. [`--log.enabled`](#--logenabled) @@ -42,6 +43,7 @@ description: Guide to use arguments of FORT Validator. 28. [`--validation-log.level`](#--validation-loglevel) 29. [`--validation-log.output`](#--validation-logoutput) 30. [`--validation-log.color-output`](#--validation-logcolor-output) + 30. [`--aspa.max-providers`](#--aspamax-providers) 31. [`--validation-log.file-name-format`](#--validation-logfile-name-format) 32. [`--validation-log.facility`](#--validation-logfacility) 33. [`--validation-log.tag`](#--validation-logtag) @@ -60,6 +62,7 @@ description: Guide to use arguments of FORT Validator. 42. [`--http.proxy`](#--httpproxy) 43. [`--output.roa`](#--outputroa) 44. [`--output.bgpsec`](#--outputbgpsec) + 44. [`--output.aspa`](#--outputaspa) 45. [`--output.format`](#--outputformat) 46. [`--asn1-decode-max-stack`](#--asn1-decode-max-stack) 48. [`--thread-pool.server.max`](#--thread-poolservermax) @@ -95,13 +98,14 @@ description: Guide to use arguments of FORT Validator. [--work-offline=true|false] [--daemon=true|false] [--server.address=] - [--server.port=] + [--server.port=] [--server.backlog=] [--server.interval.validation=] [--server.interval.refresh=] [--server.interval.retry=] [--server.interval.expire=] [--server.deltas.lifetime=] + [--server.max-rtr-version=] [--prometheus.port=] [--rsync.enabled=true|false] [--rsync.priority=] @@ -120,7 +124,7 @@ description: Guide to use arguments of FORT Validator. [--http.low-speed-time=] [--http.max-file-size=] [--http.ca-path=] - [--http.proxy=] + [--http.proxy=] [--log.enabled=true|false] [--log.output=syslog|console] [--log.level=error|warning|info|debug] @@ -135,13 +139,16 @@ description: Guide to use arguments of FORT Validator. [--validation-log.facility=auth|authpriv|cron|daemon|ftp|lpr|mail|news|user|uucp|local0|local1|local2|local3|local4|local5|local6|local7] [--validation-log.file-name-format=global-url|local-path|file-name] [--validation-log.color-output=true|false] + [--aspa.max-providers=] [--output.roa=] [--output.bgpsec=] + [--output.aspa=] [--output.format=csv|json] [--asn1-decode-max-stack=] [--init-tals=true|false] [--init-as0-tals=true|false] [--thread-pool.server.max=] + [--file-type=roa|mft|gbr|cer|crl] ``` If an argument is specified more than once, the last one takes precedence: @@ -174,9 +181,9 @@ Usage: {{ page.command }} [--init-as0-tals=true|false] (Fetch the currently-known AS0 TAL files into --tal) [--thread-pool.server.max=] - (Maximum number of active threads (one thread per RTR client) that can live at the thread pool) - [--thread-pool.validation.max=] - (Maximum number of active threads (one thread per TAL) that can live at the thread pool) + (Number of threads in the RTR client request thread pool. Also known as the maximum number of client requests the RTR server will be able to handle at the same time.) + [--file-type=roa|mft|gbr|cer|crl] + (Parser for --mode=print) {% endhighlight %} The slightly larger usage message is `man {{ page.command }}` and the large usage message is this documentation. @@ -195,9 +202,9 @@ Usage: {{ page.command }} [--usage] [--version] ... - [--log.file-name-format=global-url|local-path|file-name] - [--output.roa=] - [--output.bgpsec=] + [--init-as0-tals=true|false] + [--thread-pool.server.max=] + [--file-type=roa|mft|gbr|cer|crl] {% endhighlight %} ### `--version` @@ -405,7 +412,7 @@ See the corresponding manual page from your operating system (likely `man 2 list - **Type:** Integer - **Availability:** `argv` and JSON - **Default:** 3600 -- **Range:** [60, [`UINT_MAX`](http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/limits.h.html)] +- **Range:** [60, 7 days] Number of seconds Fort will sleep between validation cycles, when in [`server`](#--mode) mode. @@ -456,8 +463,8 @@ See [RFC 8210, section 6](https://tools.ietf.org/html/rfc8210#section-6). - **Type:** Integer - **Availability:** `argv` and JSON -- **Default:** 21600 (6 hours) -- **Range:** [1, [`UINT_MAX`](http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/limits.h.html)] +- **Default:** 6 +- **Range:** [1, 1000] RTR delta lifetime, measured in validation cycles. @@ -467,6 +474,23 @@ Fort stores the information necessary to serve these deltas in the cache. `--ser If a router lags behind, to the point Fort has already deleted the deltas it needs to update the router's snapshot, Fort will have to fall back to fetch the entire latest snapshot instead. +### `--server.max-rtr-version` + +- **Type:** Integer +- **Availability:** `argv` and JSON +- **Default:** 0 +- **Range:** [0, 2] + +Maximum RTR version the server will be willing to negotiate with RTR clients. + +RTRv0 is [RFC6810](https://datatracker.ietf.org/doc/html/rfc6810), RTRv1 is [RFC8210](https://datatracker.ietf.org/doc/html/rfc8210), and at time of writing, RTRv2 is [draft-ietf-sidrops-8210bis-26](https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-8210bis-26). + +RTRv0 servers Prefix VRPs. RTRv1 adds Router Keys, and RTRv2 adds ASPAs. + +At present, this value defaults to v0 because Fort's validation [currently yields no router keys](https://github.com/NICMx/FORT-validator/issues/58), and the ASPA specification is still receiving updates. Fort 1.7.0.experimental's RTRv2 implementation is draft-ietf-sidrops-8210bis-25, not 26. + +The default value is expected to grow as the implementation matures. + ### `--prometheus.port` - **Type:** Integer @@ -534,6 +558,17 @@ Include ANSI color codes in the logging? Meant to ease human consumption. Only a See [Logging > Configuration > Color output](logging.html#color-output). +### `--aspa.max-providers` + +- **Type:** Integer +- **Availability:** `argv` and JSON +- **Default:** 4000 +- **Range:** [0, 16380] + +Maximum number of providers each customerASID is allowed to declare across all RPKI trees during each validation cycle. + +Customers that exceed this provider count will be invalidated. + ### `--log.file-name-format` - **Type:** Enumeration (`global-url`, `local-path`, `file-name`) @@ -839,32 +874,42 @@ https_proxy=https://example.com:1234 fort --tal=/path/to/tal - **Availability:** `argv` and JSON - **Default:** `NULL` (disabled) -File where the ROAs (found during each validation run) will be stored. See [`--output.format`](#--outputformat). +Assigns a file where Fort will print the valid VRPs found after each validation run. + +If the file already exists, it will be overwritten. If it doesn't exist, it will be created. To print to standard output, assign a hyphen (`-`). -If the file already exists, it will be overwritten. If it doesn't exist, it will be created. To print to standard output, use a hyphen (`-`). If the RTR server is [enabled](#--mode), then the ROAs will be printed every [`--server.interval.validation`](#--serverintervalvalidation) secs. +Sample output when [`--output.format`](#--outputformat) equals `csv`: -When `--output.format` equals `csv`, each line of the result is printed in the following order: _AS, Prefix, Max prefix length_. The first line contains the column names. +```csv +ASN,Prefix,Max prefix length +AS1000,192.0.2.0/24,24 +AS10001,203.0.113.0/28,30 +AS24047,2001:db8::/64,96 +``` -When `--output.format` equals `json`, each element is printed in an object array of `roas`: +Sample output when `--output.format` equals `json`: -{% highlight json %} +```json { "roas": [ { - "asn": "AS64496", - "prefix": "198.51.100.0/24", - "maxLength": 24 - }, - { - "asn": "AS64496", - "prefix": "2001:DB8::/32", - "maxLength": 48 + "asn": "AS1000", + "prefix": "192.0.2.0/24", + "maxLength": 30 + }, { + "asn": "AS10001", + "prefix": "203.0.113.0/28", + "maxLength": 30 + }, { + "asn": "AS24047", + "prefix": "2001:db8::/64", + "maxLength": 96 } ] } -{% endhighlight %} +``` -If `--output.roa` is omitted, the ROAs are not printed. +If absent, VRPs are not printed. ### `--output.bgpsec` @@ -903,6 +948,31 @@ When `--output.format` equals `json`, each element is printed in an object array If `--output.bgpsec` is ommited, then the BGPsec Router Keys are not printed. +### `--output.aspa` + +- **Type:** String (Path to file) +- **Availability:** `argv` and JSON +- **Default:** `NULL` (disabled) + +Assigns a file where Fort will print the valid ASPAs found after each validation run. ASPAs are always printed in JSON format. + +If the file already exists, it will be overwritten. If it doesn't exist, it will be created. To print to standard output, assign a hyphen (`-`). + +Each element is identifier by its customerASID, and its value is an array of provider ASIDs: + +```json +{ + "aspa" : { + "2": [ 10000, 10001, 10002 ], + "1513": [ 10000 ], + "65500": [ 4221, 61971, 87645 ], + "16777217": [ 39, 410, 503, 8018622 ] + } +} +``` + +If absent, ASPAs are not printed. + ### `--output.format` - **Type:** Enumeration (`csv`, `json`) @@ -1022,7 +1092,8 @@ The configuration options are mostly the same as the ones from the `argv` interf }, "deltas": { "lifetime": 2 - } + }, + "max-rtr-version": 0 }, "prometheus": { @@ -1036,7 +1107,6 @@ The configuration options are mostly the same as the ones from the `argv` interf "count": 1, "interval": 4 }, - "transfer-timeout": 900, "program": "rsync", "arguments-recursive": [ "-rtz", @@ -1045,16 +1115,19 @@ The configuration options are mostly the same as the ones from the `argv` interf "--contimeout=20", "--max-size=20MB", "--timeout=15", + "--exclude=.*", "--include=*/", "--include=*.cer", + "--include=*.roa", + "--include=*.asa", + "--include=*.mft", "--include=*.crl", "--include=*.gbr", - "--include=*.mft", - "--include=*.roa", "--exclude=*", "$REMOTE", "$LOCAL" - ] + ], + "transfer-timeout": 900 }, "http": { @@ -1094,6 +1167,10 @@ The configuration options are mostly the same as the ones from the `argv` interf "file-name-format": "global-url", "color-output": false }, + + "aspa": { + "max-providers": 4000 + }, "incidences": [ { @@ -1118,8 +1195,9 @@ The configuration options are mostly the same as the ones from the `argv` interf ], "output": { - "roa": null, - "bgpsec": null, + "roa": "vrps.csv", + "bgpsec": "rks.csv", + "aspa": "aspas.json", "format": "csv" }, @@ -1182,7 +1260,7 @@ Name of the program needed to invoke an rsync file transfer. - **Type:** String array - **Availability:** JSON only -- **Default:** `[ "-rtz", "--delete", "--omit-dir-times", "--contimeout=20", "--max-size=20MB", "--timeout=15", "--include=*/", "--include=*.cer", "--include=*.crl", "--include=*.gbr", "--include=*.mft", "--include=*.roa", "--exclude=*", "$REMOTE", "$LOCAL" ]` +- **Default:** `[ "-rtz", "--delete", "--omit-dir-times", "--contimeout=20", "--max-size=20MB", "--timeout=15", "--exclude=.*", "--include=*/", "--include=*.cer", "--include=*.roa", "--include=*.asa", "--include=*.mft", "--include=*.crl", "--include=*.gbr", "--exclude=*", "$REMOTE", "$LOCAL" ]` Arguments needed by [`rsync.program`](#rsyncprogram) to perform a recursive rsync. @@ -1202,7 +1280,7 @@ A listing of actions to be performed by validation upon encountering certain err - **Type:** Boolean (`true`, `false`) - **Availability:** `argv` and JSON -> ![img/warn.svg](img/warn.svg) This argument **is DEPRECATED**. +> ![img/warn.svg](img/warn.svg) This argument is deprecated. Does nothing as of Fort 1.6.0. @@ -1212,7 +1290,7 @@ Does nothing as of Fort 1.6.0. - **Availability:** `argv` and JSON - **Range:** [0, [`UINT_MAX`](http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/limits.h.html)] -> ![img/warn.svg](img/warn.svg) This argument **is DEPRECATED**. +> ![img/warn.svg](img/warn.svg) This argument is deprecated. Does nothing as of Fort 1.6.0. @@ -1221,7 +1299,7 @@ Does nothing as of Fort 1.6.0. - **Type:** Enumeration (`strict`, `root`, `root-except-ta`) - **Availability:** `argv` and JSON -> ![img/warn.svg](img/warn.svg) This argument **is DEPRECATED**. +> ![img/warn.svg](img/warn.svg) This argument is deprecated. Does nothing as of Fort 1.6.0. @@ -1230,7 +1308,7 @@ Does nothing as of Fort 1.6.0. - **Type:** String array - **Availability:** JSON only -> ![img/warn.svg](img/warn.svg) This argument **is DEPRECATED**. +> ![img/warn.svg](img/warn.svg) This argument is deprecated. Does nothing as of Fort 1.6.0. @@ -1240,6 +1318,6 @@ Does nothing as of Fort 1.6.0. - **Availability:** `argv` and JSON - **Range:** [1, 100] -> ![img/warn.svg](img/warn.svg) This argument **is DEPRECATED**. +> ![img/warn.svg](img/warn.svg) This argument is deprecated. Does nothing as of Fort 1.6.0. diff --git a/man/fort.8 b/man/fort.8 index 5bd5eb6a..0b871ef0 100644 --- a/man/fort.8 +++ b/man/fort.8 @@ -1,4 +1,4 @@ -.TH fort 8 "2026-05-29" "v1.6.8" "FORT validator" +.TH fort 8 "2026-07-14" "v1.7.0.experimental" "FORT validator" .SH NAME fort \- RPKI validator and RTR server @@ -115,9 +115,9 @@ Arguments needed by to perform a recursive rsync. The arguments are specified as a JSON string array; its default value is: [ "-rtz", "--delete", "--omit-dir-times", "--contimeout=20", "--max-size=20MB", -"--timeout=15", "--include=*/", "--include=*.cer", "--include=*.crl", -"--include=*.gbr", "--include=*.mft", "--include=*.roa", "--exclude=*", -"$REMOTE", "$LOCAL" ] +"--timeout=15", "--exclude=.*", "--include=*/", "--include=*.cer", +"--include=*.roa", "--include=*.asa", "--include=*.mft", "--include=*.crl", +"--include=*.gbr", "--exclude=*", "$REMOTE", "$LOCAL" ] .P FORT will replace "$REMOTE" with the remote URL it needs to download, and "$LOCAL" with the target local directory where the file is supposed to be @@ -452,6 +452,20 @@ If a router lags behind, to the point Fort has already deleted the deltas it nee .RE .P +.B \-\-server.max\-rtr\-version=\fIUNSIGNED_INTEGER\fR +.RS 4 +Maximum RTR version the server will be willing to negotiate with RTR clients. +.P +RTRv0 is RFC6810, RTRv1 is RFC8210, and at time of writing, RTRv2 is draft-ietf-sidrops-8210bis-26. +.P +RTRv0 servers Prefix VRPs. RTRv1 adds Router Keys, and RTRv2 adds ASPAs. +.P +At present, this value defaults to v0 because Fort's validation currently yields no router keys (issue #58), and the ASPA specification is still receiving updates. Fort 1.7.0.experimental's RTRv2 implementation is draft-ietf-sidrops-8210bis-25, not 26. +.P +The default value is expected to grow as the implementation matures. +.RE +.P + .B \-\-prometheus.port=\fIUNSIGNED_INTEGER\fR .RS 4 TCP port the Prometheus server will be bound to. @@ -950,41 +964,50 @@ By default, it has a value of \fI900\fR. .RE .P +.B \-\-aspa.max\-providers=\fIUNSIGNED_INTEGER\fR +.RS 4 +Maximum number of providers each customerASID is allowed to declare across all RPKI trees during each validation cycle. +.P +Customers that exceed this provider count will be invalidated. +.RE +.P + .B \-\-output.roa=\fIFILE\fR .RS 4 -File where the ROAs will be printed in the configured format (see -\fI--output.format\fR). +Assigns a file where Fort will print the valid VRPs found after each validation run. .P -When the \fIFILE\fR is specified, its content will be overwritten by the -resulting ROAs of the validation (if FILE doesn't exists, it'll be created). +If the file already exists, it will be overwritten. If it doesn't exist, it will be created. To print to standard output, assign a hyphen. .P -When \fI--output.format=csv\fR (which is the default value), then each line of -the result is printed in the following order: AS, Prefix, Max prefix length; the -first line contains those column descriptors. +Sample output when \fI--output.format=csv\fR: .P -When \fI--output.format=json\fR, then each element is printed inside an object -array of "roas"; ie: .nf -{ - "roas": [ - { - "asn": "AS64496", - "prefix": "198.51.100.0/24", - "maxLength": 24 - }, - { - "asn": "AS64496", - "prefix": "2001:DB8::/32", - "maxLength": 48 - } - ] -} + ASN,Prefix,Max prefix length + AS1000,192.0.2.0/24,24 + AS10001,203.0.113.0/28,30 + AS24047,2001:db8::/64,96 .fi .P -In order to print the ROAs at console, use a hyphen as the \fIFILE\fR value, eg. -.B \-\-output.roa=- +Sample output when \fI--output.format=json\fR: .P -By default, it has no value set. +.nf + { "roas": [ + { + "asn": "AS1000", + "prefix": "192.0.2.0/24", + "maxLength": 30 + }, { + "asn": "AS10001", + "prefix": "203.0.113.0/28", + "maxLength": 30 + }, { + "asn": "AS24047", + "prefix": "2001:db8::/64", + "maxLength": 96 + } + ] } +.fi +.P +If absent, VRPs are not printed. .RE .P @@ -1006,6 +1029,7 @@ Subject Public Key Info; the first line contains those column descriptors. .P When \fI--output.format=json\fR, then each element is printed inside an object array of "router-keys"; ie: +.P .nf { "router-keys": [ @@ -1031,6 +1055,29 @@ By default, it has no value set. .RE .P +.B \-\-output.aspa=\fIFILE\fR +.RS 4 +Assigns a file where Fort will print the valid ASPAs found after each validation run. ASPAs are always printed in JSON format. +.P +If the file already exists, it will be overwritten. If it doesn't exist, it will be created. To print to standard output, assign a hyphen. +.P +Each element is identifier by its customerASID, and its value is an array of provider ASIDs: +.P +.nf +{ + "aspa" : { + "2": [ 10000, 10001, 10002 ], + "1513": [ 10000 ], + "65500": [ 4221, 61971, 87645 ], + "16777217": [ 39, 410, 503, 8018622 ] + } +} +.fi +.P +If absent, ASPAs are not printed. +.RE +.P + .B \-\-output.format=\fIcsv\fR|\fIjson\fR .RS 4 Output format for \fI--output.roa\fR and \fI--output.bgpsec\fR. @@ -1111,6 +1158,7 @@ validating every 30 minutes, and printing the ROAs CSV in a file. .RS 4 This is an example of a valid JSON configuration file with all its members set to a specific value: +.P .nf { "tal": "/tmp/fort/tal/", @@ -1253,6 +1301,7 @@ to a specific value: .RS 4 This is an example of a SLURM file with some prefix filters and assertions, as well as some dummy Router Keys (BGPsec) info: +.P .nf { diff --git a/src/asn1/asn1c/ASProviderAttestation.c b/src/asn1/asn1c/ASProviderAttestation.c index 7e383a55..aa8c54b1 100644 --- a/src/asn1/asn1c/ASProviderAttestation.c +++ b/src/asn1/asn1c/ASProviderAttestation.c @@ -39,8 +39,8 @@ static asn_TYPE_member_t asn_MBR_ASProviderAttestation_1[] = { (ASN_TAG_CLASS_CONTEXT | (0 << 2)), +1, /* EXPLICIT tag at current level */ &asn_DEF_INTEGER, - 0, - { 0, 0, 0 }, + NULL, + { NULL, NULL, NULL }, &asn_DFL_2_cmp_0, /* Compare DEFAULT 0 */ &asn_DFL_2_set_0, /* Set DEFAULT 0 */ "version" @@ -49,18 +49,18 @@ static asn_TYPE_member_t asn_MBR_ASProviderAttestation_1[] = { (ASN_TAG_CLASS_UNIVERSAL | (2 << 2)), 0, &asn_DEF_ASId, - 0, - { 0, 0, 0 }, - 0, 0, /* No default value */ + NULL, + { NULL, NULL, NULL }, + NULL, NULL, /* No default value */ "customerASID" }, { ATF_NOFLAGS, 0, offsetof(struct ASProviderAttestation, providers), (ASN_TAG_CLASS_UNIVERSAL | (16 << 2)), 0, &asn_DEF_ProviderASSet, - 0, - { 0, 0, 0 }, - 0, 0, /* No default value */ + NULL, + { NULL, NULL, NULL }, + NULL, NULL, /* No default value */ "providers" }, }; @@ -89,7 +89,7 @@ asn_TYPE_descriptor_t asn_DEF_ASProviderAttestation = { asn_DEF_ASProviderAttestation_tags_1, /* Same as above */ sizeof(asn_DEF_ASProviderAttestation_tags_1) /sizeof(asn_DEF_ASProviderAttestation_tags_1[0]), /* 1 */ - { 0, 0, SEQUENCE_constraint }, + { NULL, NULL, SEQUENCE_constraint }, asn_MBR_ASProviderAttestation_1, 3, /* Elements count */ &asn_SPC_ASProviderAttestation_specs_1 /* Additional specs */ diff --git a/src/asn1/asn1c/ProviderASSet.c b/src/asn1/asn1c/ProviderASSet.c index 5444945f..9ac31c19 100644 --- a/src/asn1/asn1c/ProviderASSet.c +++ b/src/asn1/asn1c/ProviderASSet.c @@ -14,9 +14,9 @@ asn_TYPE_member_t asn_MBR_ProviderASSet_1[] = { (ASN_TAG_CLASS_UNIVERSAL | (2 << 2)), 0, &asn_DEF_ASId, - 0, - { 0, 0, 0 }, - 0, 0, /* No default value */ + NULL, + { NULL, NULL, NULL }, + NULL, NULL, /* No default value */ "" }, }; diff --git a/src/config.c b/src/config.c index 675fff6c..0f29e8e1 100644 --- a/src/config.c +++ b/src/config.c @@ -445,7 +445,7 @@ static const struct option_field options[] = { .name = "server.max-rtr-version", .type = >_uint, .offset = offsetof(struct rpki_config, server.max_rtr_version), - .doc = "Maximum RTR version to serve (0-2).", + .doc = "Maximum RTR version the server will be willing to negotiate with RTR clients", .min = 0, .max = 2, }, @@ -744,7 +744,7 @@ static const struct option_field options[] = { .name = "aspa.max-providers", .type = >_uint, .offset = offsetof(struct rpki_config, aspa.max_providers), - .doc = "Maximum allowed providers per customer", + .doc = "Maximum number of providers each customerASID is allowed to declare across all RPKI trees during each validation cycle", .min = 0, .max = 16380u, }, @@ -764,7 +764,7 @@ static const struct option_field options[] = { .name = "output.roa", .type = >_string, .offset = offsetof(struct rpki_config, output.roa), - .doc = "File where ROAs will be stored, use '-' to print at console", + .doc = "File where VRPs will be stored. ('-' for stdout)", .arg_doc = "", .json_null_allowed = true, }, { @@ -772,7 +772,7 @@ static const struct option_field options[] = { .name = "output.bgpsec", .type = >_string, .offset = offsetof(struct rpki_config, output.bgpsec), - .doc = "File where BGPsec Router Keys will be stored, use '-' to print at console", + .doc = "File where BGPsec Router Keys will be stored. ('-' for stdout)", .arg_doc = "", .json_null_allowed = true, }, { @@ -780,7 +780,7 @@ static const struct option_field options[] = { .name = "output.aspa", .type = >_string, .offset = offsetof(struct rpki_config, output.aspa), - .doc = "Path to file where ASPAs will be stored. ('-' for stdout)", + .doc = "File where ASPAs will be stored. ('-' for stdout)", .arg_doc = "", .json_null_allowed = true, }, { diff --git a/src/extension.c b/src/extension.c index 17cd06b6..d897e9c5 100644 --- a/src/extension.c +++ b/src/extension.c @@ -125,7 +125,7 @@ ku2json(void const *ext) json_t *child; ku_len = ASN1_STRING_length(ku); - if (ku_len != 1 || ku_len != 2) + if (ku_len != 1 && ku_len != 2) return NULL; parent = json_obj_new(); diff --git a/src/rtr/pdu_handler.c b/src/rtr/pdu_handler.c index d148687d..139b6a90 100644 --- a/src/rtr/pdu_handler.c +++ b/src/rtr/pdu_handler.c @@ -222,7 +222,7 @@ again: n = fread(buf, size, 1, file); static int send_serial(struct rtr_stream *stream, serial_t serial) { - FILE *file = 0; + FILE *file = NULL; unsigned char *buf; unsigned char const *chunk; int error; @@ -248,7 +248,7 @@ end: free(buf); static int send_aspas(int fd, uint8_t ver, serial_t serial) { - FILE *file = 0; + FILE *file = NULL; unsigned char buf[8]; unsigned char const *chunk; int error; diff --git a/test/rtr/pdu_handler_test.c b/test/rtr/pdu_handler_test.c index 52779a98..7e431b7e 100644 --- a/test/rtr/pdu_handler_test.c +++ b/test/rtr/pdu_handler_test.c @@ -17,7 +17,7 @@ #include "types/router_key.c" #include "types/serial.c" -unsigned int deltas_lifetime = 5; +static unsigned int deltas_lifetime = 5; MOCK(config_get_local_repository, char const *, "tmp", void) MOCK_UINT(config_get_deltas_lifetime, deltas_lifetime, void) @@ -116,7 +116,7 @@ mock_commit(struct db_table *tbl) return session; } -uint16_t +static uint16_t mock_serial1(void) { struct db_table *tbl = db_table_create(); @@ -124,7 +124,7 @@ mock_serial1(void) return mock_commit(tbl); } -void +static void mock_serial2(void) { struct db_table *tbl = db_table_create(); @@ -133,7 +133,7 @@ mock_serial2(void) mock_commit(tbl); } -void +static void mock_serial3(void) { struct db_table *tbl = db_table_create(); @@ -141,7 +141,7 @@ mock_serial3(void) mock_commit(tbl); } -void +static void mock_serial4(void) { struct db_table *tbl = db_table_create();