The "currently known core TALs" are

https://rpki.afrinic.net/tal/afrinic.tal
https://tal.apnic.net/apnic.tal
https://www.arin.net/resources/manage/rpki/arin.tal
https://www.lacnic.net/innovaportal/file/4983/1/lacnic.tal
https://tal.rpki.ripe.net/ripe-ncc.tal

Please note that ARIN requires that you accept a Relying Party Agreement before you can download their TAL: https://www.arin.net/resources/manage/rpki/rpa.pdf

The "currently known AS0 TALs" are

https://tal.apnic.net/apnic-as0.tal
https://www.lacnic.net/innovaportal/file/4983/1/lacnic-as0.tal

The configuration options are mostly the same as the ones presented in this manual. Each property is mapped as a member of the main JSON object, the members that contain a dot '.' must be set as objects (eg. "--server.port=8323" will be set as "{ "server": { "port": "8323" } }".

An example configuration file can be seen in this manual at the EXAMPLES section.

Some configuration options can't be set at the JSON configuration file: --version, --help, --version, and --configuration-file.

Other configuration options can be configured exclusively at the JSON configuration file:

rsync.program

rsync.arguments-recursive

rsync.arguments-flat

incidences

The TAL ("Trust Anchor Locator") is a text file that lists a few URLs which can be used to access the "Trust Anchor" (the root of a particular RPKI tree) and its public key. (See RFC 8630.)

FORT accesses RPKI repositories either with rsync or RRDP (see RFC 8182). During each validation cycle, and depending on the preferred access methods defined by the CAs, Fort can do two things:

Fort's entire validation process operates on the resulting copy of the files (doesn't matter if the files where fetched by rsync of https).

Because rsync uses delta encoding, you’re advised to keep this cache around. It significantly speeds up subsequent validation cycles.

By default, the path is /tmp/fort/repository.

All the enabled logs will be sent to syslog, so the configured values of --log.output and --validation-log.output will be ignored.

rsync download strategy; states the way rsync URLs are approached during downloads.

Despite this argument will be deprecated, it still can be utilized. It can have one of four values:

Otherwise, Fort will perform outgoing requests whenever this is needed. If a specific protocol needs to be deactivated, use --rsync.enabled or --http.enabled.

By default, the flag is disabled.

This flag is only relevant if the TAL lists more than one URL. Regardless of this flag, FORT will stop iterating through the URLs as soon as it finds one that yields a successful traversal.

If the TAL lists more than one URL, the shuffle is done honoring the priority of the protocols (see --rsync.priority and --http.priority). i.e. if the HTTP protocol has a higher priority than RSYNC, then all the shuffled HTTP URLs will come first.

By default, it has a value of 32. The minimum allowed value is 5.

(Required to prevent loops and "other degenerate forms of the logical RPKI hierarchy." (RFC 6481))

The SLURM definition is from RFC 8416. SLURM stands for "Simplified Local Internet Number Resource Management with the RPKI", basically is a document that can override (either as a filter or adding assertions) the global RPKI repository data fetched by FORT; potentially useful for network operators.

In case a DIRECTORY is set, the files with extension '.slurm' will be the ones considered as SLURM files and FORT will use them.

The configured SLURM path (either FILE or DIRECTORY) will be read each time a new validation cycle begins. If there's a syntax or content error, the last valid version of the SLURM will be applied (if there's one) and a message will be logged to indicate this action. Note that all this will happen only if --mode=server and --slurm is configured.

A basic example of a SLURM file can be seen in this manual at the EXAMPLES section (it's almost the same as the one in RFC 8416).

See more about SLURM configuration at FORT's web docs.

server

standalone

By default, the mode is server.

The list of addresses must be comma sepparated, and each address must have the following format: <address>[#<port>]. Note that the port is optional; in case that a port isn't specified, the value of --server.port will be utilized with the corresponding address.

Here are some examples of valid values for this argument:
- --server.address="localhost": will bind to 'localhost' and the configured port at --server.port.
- --server.address="localhost,::1#8324": same as the previous example, and also will bind to IPv6 address '::1' at the port '8324'.
- --server.address="localhost#8323,::1#8324": will bind to 'localhost' at port '8323', and to '::1' port '8324'. The value of --server.port isn't utilized.

If this field is omitted, FORT will attempt to bind the server using the IP address INADDR_ANY (for an IPv4 address) or IN6ADDR_ANY_INIT (for an IPv6 address). See getaddrinfo(3).

This is a string because a service alias can be used as a valid value. The alias are commonly located at /etc/services. See also getaddrinfo(3) and services(5).

The default port (323) is privileged. To improve security, either change or jail it.

In case you don't wish to use another port nor execute FORT validator as root, you could use CAP_NET_BIND_SERVICE capability (to bind to privileged ports), or NAT/firewall port redirection.

By default, it has a value of SOMAXCONN.

By default, it has a value of 3600.

This value is utilized only on RTR version 1 sessions (more information at RFC 8210 section 6).

By default, it has a value of 3600. Minimum allowed value: 1, maximum allowed value 86400.

This value is utilized only on RTR version 1 sessions (more information at RFC 8210 section 6).

By default, it has a value of 600. Minimum allowed value: 1, maximum allowed value 7200.

This value is utilized only on RTR version 1 sessions (more information at RFC 8210 section 6).

By default, it has a value of 7200. Minimum allowed value: 600, maximum allowed value 172800. It must be larger than server.interval.refresh and server.interval.retry.

During each validation cycle, Fort generates a new snapshot, as well as the deltas needed to build the new snapshot from the previous one. These are all stored in RAM. --server.deltas.lifetime is the number of iterations a set of deltas will be kept before being deallocated. (Recall that every iteration lasts --server.interval.validation seconds, plus however long the validation takes.)

If a router lags behind, to the point Fort has already deleted the deltas it needs to update the router’s snapshot, Fort will have to fall back to fetch the entire latest snapshot instead.

By default, it has a value of true (these logs are enabled).

Read more about logs at FORT validator's web docs, module 'Logging'.

The priority levels, from higher to lowest, are:

By default, it has a value of warning.

Read more about logs at FORT validator's web docs, module 'Logging'.

The value console will log messages at standard output and standard error; syslog will log to syslog.

Depending on the OS, distinct implementations of syslog could be installed (syslog, rsyslog, or syslog-ng are the most common ones). Syslog usage and configuration is out of this man scope.

By default, it has a value of console.

Read more about logs at FORT validator's web docs, module 'Logging'.

Meaningful only if --log.output value is console.

By default, it has a value of false (it's disabled).

Read more about logs at FORT validator's web docs, module 'Logging'.

Suppose a certificate was downloaded from `rsync://rpki.example.com/foo/bar/baz.cer` into the local cache `repository/`:

global-url

local-path

file-name

By default, it has a value of global-url.

Read more about logs at FORT validator's web docs, module 'Logging'.

By default, it has a value of daemon.

Read more about logs at FORT validator's web docs, module 'Logging'.

By default, it has a NULL value.

Read more about logs at FORT validator's web docs, module 'Logging'.

By default, it has a value of false (these logs are disabled).

Read more about logs at FORT validator's web docs, module 'Logging'.

The priority levels, from higher to lowest, are:

By default, it has a value of warning.

Read more about logs at FORT validator's web docs, module 'Logging'.

The value console will log messages at standard output and standard error; syslog will log to syslog.

Depending on the OS, distinct implementations of syslog could be installed (syslog, rsyslog, or syslog-ng are the most common ones). Syslog usage and configuration is out of this man scope.

By default, it has a value of console.

Read more about logs at FORT validator's web docs, module 'Logging'.

Meaningful only if --validation-log.output value is console.

By default, it has a value of false (it's disabled).

Read more about logs at FORT validator's web docs, module 'Logging'.

Suppose a certificate was downloaded from `rsync://rpki.example.com/foo/bar/baz.cer` into the local cache `repository/`:

global-url

local-path

file-name

By default, it has a value of global-url.

Read more about logs at FORT validator's web docs, module 'Logging'.

By default, it has a value of daemon.

Read more about logs at FORT validator's web docs, module 'Logging'.

By default, it has the value Validation.

Read more about logs at FORT validator's web docs, module 'Logging'.

If disabled (eg. --http.enabled=false), FORT validator won't request HTTP URIs, and will expect to find all the corresponding repository files at --local-repository.

This argument works along with --rsync.priority, since the higher value of the two arguments will result in the first protocol to utilize when fetching repositories files. Of course, this depends also on certificates information or the TAL URIs, since currently HTTP URIs are optional and not every RIR repository makes use of them.

Whenever a certificate or a TAL has both RSYNC and HTTP URIs, the following criteria is followed to prioritize which one to use first:

By default, the value is 60, so HTTP requests are preferred over rsync requests.

A value of 0 means no retries.

Whenever is necessary to request an HTTP URI, the validator will try the request at least once. If there was an error requesting the URI, the validator will retry at most --http.retry.count times to fetch the file, waiting --http.retry.interval seconds between each retry.

By default, the value is 2.

By default, the value is 5.

The value specified (either by the argument or the default value) is utilized in libcurl’s option CURLOPT_USERAGENT.

By default, the value is fort/<current-version>.

Whenever an HTTP connection will try to be established, the validator will wait a maximum of http.connect-timeout seconds for the peer to respond to the connection request; if the timeout is reached, the connection attempt will be ceased.

The value specified (either by the argument or the default value) is utilized in libcurl’s option CURLOPT_CONNECTTIMEOUT.

By default, it has a value of 30. The minimum allowed value is 1.

Once the connection is established with the server, the request will last a maximum of http.transfer-timeout seconds. A value of 0 means unlimited time (default value).

The value specified (either by the argument or the default value) is utilized in libcurl’s option CURLOPT_TIMEOUT.

By default, it has a value of 0.

"Abort connection if slower than LIMIT bytes/sec during TIME seconds."

(See --low-speed-time.)

Default: 100000 (100 KB/s)

"Abort connection if slower than LIMIT bytes/sec during TIME seconds."

(See --low-speed-limit.)

Default: 10

Default: 1000000000 (1 GB)

Useful when the CA from the peer isn’t located at the default OS certificate bundle. If specified, the peer certificate will be verified using the CAs at the path. The directory MUST be prepared using the rehash utility from the SSL library:

The value specified is utilized in libcurl’s option CURLOPT_CAPATH.

By default, the path has a NULL value.

If disabled (eg. --rsync.enabled=false), FORT validator won't download files nor directories via RSYNC, and will expect to find all repository files at --local-repository.

This argument works along with --http.priority, since the higher value of the two arguments will result in the first protocol to utilize when fetching repositories files. Of course, this depends also on certificates information or the TAL URIs, since currently HTTP URIs are optional and not every RIR repository makes use of them.

Whenever a certificate has both RSYNC and HTTP URIs, the following criteria is followed to prioritize which one to use first:

By default, the value is 50, so HTTP requests are preferred over rsync requests.

strict

root

root-except-ta

A value of 0 means no retries.

Whenever is necessary to execute an RSYNC, the validator will try the execution at least once. If there was an error executing the RSYNC, the validator will retry it at most --rsync.retry.count times, waiting --rsync.retry.interval seconds between each retry.

By default, the value is 2.

By default, the value is 5.

When the FILE is specified, its content will be overwritten by the resulting ROAs of the validation (if FILE doesn't exists, it'll be created).

When --output.format=csv (which is the default value), then each line of the result is printed in the following order: AS, Prefix, Max prefix length; the first line contains those column descriptors.

When --output.format=json, then each element is printed inside an object array of "roas"; ie:

{
  "roas": [
    {
      "asn": "AS64496",
      "prefix": "198.51.100.0/24",
      "maxLength": 24
    },
    {
      "asn": "AS64496",
      "prefix": "2001:DB8::/32",
      "maxLength": 48
    }
  ]
}

In order to print the ROAs at console, use a hyphen as the FILE value, eg. --output.roa=-

By default, it has no value set.

Since most of the data is binary (Subject Key Identifier and Subject Public Key Info), such data is base64url encoded without trailing pads.

When the FILE is specified, its content will be overwritten by the resulting Router Keys of the validation (if FILE doesn't exists, it'll be created).

When --output.format=csv (which is the default value), then each line of the result is printed in the following order: AS, Subject Key Identifier, Subject Public Key Info; the first line contains those column descriptors.

When --output.format=json, then each element is printed inside an object array of "router-keys"; ie:

{
  "router-keys": [
    {
      "asn": "AS64496",
      "ski": "<Base64 Encoded SKI>",
      "spki": "<Base64 Encoded SPKI>"
    },
    {
      "asn": "AS64496",
      "ski": "<Base64 Encoded SKI>",
      "spki": "<Base64 Encoded SPKI>"
    }
  ]
}

In order to print the Router Keys at console, use a hyphen as the FILE value, eg. --output.bgpsec=-

By default, it has no value set.

By default, it has a value of csv.

Minimum: 1
Maximum: UINT_MAX
Default: 20

When a validation cycle begins, one thread per configured TAL is utilized; once the whole RPKI tree of the TAL is validated, the thread is returned to the pool.

If there are more TALs at --tal than --thread-pool.validation.max threads at the pool, is very likely that the validation cycles take a bit more of time to complete since only --thread-pool.validation.max threads will be working at the same time. E.g. if --thread-pool.validation.max=2 and the location at --tal has 4 TAL files, only 2 TALs will be validated simultaneously while the rest waits in a queue until there's an available thread at the pool to attend them.

By default, it has a value of 5. Minimum allowed value: 1, maximum allowed value 100.

By default, it has a value of 4096 (4 kB).

A repository is considered stale if its files can't be fetched due to a communication error and this error persists across validation cycles. This kind of issues can be due to a local misconfiguration (eg. a firewall that blocks incoming data) or a problem at the server (eg. the server is down).

Despite who's "fault" is, FORT validator will try to work with the local files from --local-repository.

The communication errors sent to the operation log, are those related to "first level" RPKI servers; commonly this are the servers maintained by the RIRs.

Currently all the communication errors are logged at the validation log. This argument (--stale-repository-period) is merely to send this error messages also to the operation log.

A value equal to 0 means that the communication errors will be logged at once.

By default, it has a value of 43200 (12 hours).

{
  "tal": "/tmp/fort/tal/",
  "local-repository": "/tmp/fort/repository/",
  "work-offline": false,
  "shuffle-uris": true,
  "maximum-certificate-depth": 32,
  "mode": "server",
  "daemon": false,
  "slurm": "/tmp/fort/test.slurm",
  "server": {
    "address": [
      "192.0.2.1",
      "2001:db8::1"
    ],
    "port": "8323",
    "backlog": 64,
    "interval": {
      "validation": 3600,
      "refresh": 3600,
      "retry": 600,
      "expire": 7200
    },
    "deltas": {
      "lifetime": 4
    }
  },
  "log": {
    "enabled": true,
    "level": "warning",
    "output": "console",
    "color-output": true,
    "file-name-format": "local-path",
    "facility": "daemon",
    "tag": "Operation"
  },
  "validation-log": {
    "enabled": false,
    "level": "warning",
    "output": "console",
    "color-output": true,
    "file-name-format": "local-path",
    "facility": "daemon",
    "tag": "Validation"
  },
  "http": {
    "enabled": true,
    "priority": 60,
    "retry": {
      "count": 2,
      "interval": 5
    },
    "user-agent": "fort/1.5.1",
    "connect-timeout": 30,
    "transfer-timeout": 0,
    "idle-timeout": 15,
    "ca-path": "/usr/local/ssl/certs"
  },
  "rsync": {
    "enabled": true,
    "priority": 50,
    "strategy": "root-except-ta",
    "retry": {
      "count": 2,
      "interval": 5
    },
    "program": "rsync",
    "arguments-recursive": [
      "--recursive",
      "--delete",
      "--times",
      "--contimeout=20",
      "--timeout=15",
      "$REMOTE",
      "$LOCAL"
    ],
    "arguments-flat": [
      "--times",
      "--contimeout=20",
      "--timeout=15",
      "--dirs",
      "$REMOTE",
      "$LOCAL"
    ]
  },
  "incidences": [
    {
      "name": "incid-hashalg-has-params",
      "action": "ignore"
    },
    {
      "name": "incid-obj-not-der-encoded",
      "action": "ignore"
    },
    {
      "name": "incid-file-at-mft-not-found",
      "action": "error"
    },
    {
      "name": "incid-file-at-mft-hash-not-match",
      "action": "error"
    },
    {
      "name": "incid-mft-stale",
      "action": "error"
    },
    {
      "name": "incid-crl-stale",
      "action": "error"
    }
  ],
  "output": {
    "roa": "/tmp/fort/roas.csv",
    "bgpsec": "/tmp/fort/bgpsec.csv",
    "format": "csv"
  },
  "thread-pool": {
    "server": {
      "max": 20
    },
    "validation": {
      "max": 5
    }
  },
  "asn1-decode-max-stack": 4096,
  "stale-repository-period": 43200
}

{
  "slurmVersion": 1,
  "validationOutputFilters": {
    "prefixFilters": [
      {
        "prefix": "192.0.2.0/24",
        "comment": "All VRPs encompassed by prefix"
      },
      {
        "asn": 64496,
        "comment": "All VRPs matching ASN"
      },
      {
        "prefix": "198.51.100.0/24",
        "asn": 64497,
        "comment": "All VRPs encompassed by prefix, matching ASN"
      }
    ],
    "bgpsecFilters": [
      {
        "asn": 64496,
        "comment": "All keys for ASN"
      },
      {
        "SKI": "Q8KMeBsCto1PJ6EuhowleIGNL7A",
        "comment": "Key matching Router SKI"
      },
      {
        "asn": 64497,
        "SKI": "g5RQYCnkMpDqEbt9WazTeB19nZs",
        "comment": "Key for ASN 64497 matching Router SKI"
      }
    ]
  },
  "locallyAddedAssertions": {
    "prefixAssertions": [
      {
        "asn": 64496,
        "prefix": "198.51.100.0/24",
        "comment": "My other important route"
      },
      {
        "asn": 64496,
        "prefix": "2001:DB8::/32",
        "maxPrefixLength": 48,
        "comment": "My other important de-aggregated routes"
      }
    ],
    "bgpsecAssertions": [
      {
        "asn": 64496,
        "SKI": "Dulqji-sUM5sX5M-3mqngKaFDjE",
        "routerPublicKey": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE-rkSLXlPpL_m-L7CfCfKrv1FHrM55FsIc8fMlnjHE6Y5nTuCn3UgWfCV6sYuGUZzPZ0Ey6AvezmfcELUB87eBA"
      }
    ]
  }
}