1.\" $OpenBSD: rpki-client.8,v 1.30 2020/09/15 20:02:30 job Exp $ 2.\" 3.\" Copyright (c) 2019 Kristaps Dzonsons <kristaps@bsd.lv> 4.\" 5.\" Permission to use, copy, modify, and distribute this software for any 6.\" purpose with or without fee is hereby granted, provided that the above 7.\" copyright notice and this permission notice appear in all copies. 8.\" 9.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16.\" 17.Dd $Mdocdate: September 15 2020 $ 18.Dt RPKI-CLIENT 8 19.Os 20.Sh NAME 21.Nm rpki-client 22.Nd RPKI validator to support BGP Origin Validation 23.Sh SYNOPSIS 24.Nm 25.Op Fl Bcjnov 26.Op Fl b Ar sourceaddr 27.Op Fl d Ar cachedir 28.Op Fl e Ar rsync_prog 29.Op Fl s Ar timeout 30.Op Fl T Ar table 31.Op Fl t Ar tal 32.Op Ar outputdir 33.Sh DESCRIPTION 34The 35.Nm 36utility queries the RPKI repository system with 37.Xr openrsync 1 38to fetch all X.509 certificates, manifests, and revocation lists under a given 39.Em Trust Anchor . 40.Nm 41subsequently validates each 42.Em Route Origin Authorization Pq ROA 43by constructing and verifying a certification path for the certificate 44associated with the ROA (including checking relevant CRLs). 45.Nm 46produces lists of the 47.Em Validated ROA Payloads Pq VRPs 48in various formats. 49.Pp 50The options are as follows: 51.Bl -tag -width Ds 52.It Fl B 53Create output in the file 54.Pa bird 55in the output directory which is suitable for the BIRD internet routing daemon. 56.It Fl b Ar sourceaddr 57Tell the rsync client to use 58.Ar sourceaddr 59as the source address for connections, which is useful on machines 60with multiple interfaces. 61.It Fl c 62Create output in the file 63.Pa csv 64in the output directory as comma-separated values of the prefix in slash notation, 65the maximum prefix length, the autonomous system number, and an abbreviation 66for the trust anchor the entry is derived from. 67.It Fl d Ar cachedir 68The directory where 69.Nm 70will store the cached repository data. 71Defaults to 72.Pa /var/cache/rpki-client . 73.It Fl e Ar rsync_prog 74Use 75.Ar rsync_prog 76instead of 77.Xr openrsync 1 78to fetch repositories. 79It must accept the 80.Fl rt 81and 82.Fl -address 83flags and connect with rsync-protocol locations. 84.It Fl j 85Create output in the file 86.Pa json 87in the output directory as JSON object. 88This format is identical to that 89produced by the RIPE NCC RPKI Validator and NLnet Labs routinator. 90.It Fl n 91Assume that all requested repositories exist: don't update. 92.It Fl o 93Create output in the file 94.Pa openbgpd 95in the output directory as 96.Xr bgpd 8 97compatible input. 98If the 99.Fl B , 100.Fl c , 101and 102.Fl j 103options are not specified this is the default. 104.It Fl T Ar table 105For BIRD output generated with the 106.Fl B 107option use 108.Ar table 109as roa table name instead of the default 'ROAS'. 110.It Fl s Ar timeout 111Terminate after 112.Ar timeout 113seconds of runtime, because normal practice will restart from 114.Xr cron 8 . 115Disable by specifying 0. 116Defaults to 1 hour. 117.It Fl t Ar tal 118Specify a 119.Em Trust Anchor Location Pq TAL 120file to be used. 121This option can be used multiple times to load multiple TALs. 122By default 123.Nm 124will load all TAL files in 125.Pa /etc/rpki . 126.It Fl v 127Specified once, prints information about status. 128Twice, prints each filename as it's processed. 129.It Ar outputdir 130The directory where 131.Nm 132will write the output files. 133Defaults to 134.Pa /var/db/rpki-client/ . 135.El 136.Pp 137By default 138.Nm 139produces a list of unique 140.Li roa-set 141statements in 142.Fl o 143(OpenBGPD compatible) output. 144.Pp 145.Nm 146should be run hourly by 147.Xr cron 8 : 148use 149.Xr crontab 1 150to uncomment the entry in root's crontab. 151.\" .Sh ENVIRONMENT 152.\" For sections 1, 6, 7, and 8 only. 153.Sh FILES 154.Bl -tag -width "/var/db/rpki-client/openbgpd" -compact 155.It Pa /etc/rpki/*.tal 156default TAL files used unless 157.Fl t Ar tal 158is specified. 159.It Pa /var/cache/rpki-client 160cached repository data. 161.It Pa /var/db/rpki-client/openbgpd 162default roa-set output file. 163.El 164.Sh EXIT STATUS 165.Ex -std 166.\" For sections 1, 6, and 8 only. 167.\" .Sh EXAMPLES 168.\" .Sh DIAGNOSTICS 169.\" For sections 1, 4, 6, 7, 8, and 9 printf/stderr messages only. 170.Sh SEE ALSO 171.Xr openrsync 1 , 172.Xr bgpd.conf 5 173.Sh STANDARDS 174The following standards are used or referenced in 175.Nm : 176.Bl -tag -width -Ds 177.It RFC 3370 178Cryptographic Message Syntax (CMS) Algorithms. 179.It RFC 3779 180X.509 Extensions for IP Addresses and AS Identifiers. 181.It RFC 4291 182IP Version 6 Addressing Architecture. 183.It RFC 4631 184Classless Inter-domain Routing (CIDR): The Internet Address Assignment 185and Aggregation Plan. 186.It RFC 5280 187Internet X.509 Public Key Infrastructure Certificate and Certificate 188Revocation List (CRL) Profile. 189.It RFC 5652 190Cryptographic Message Syntax (CMS). 191.It RFC 5781 192The rsync URI Scheme. 193.It RFC 5952 194A Recommendation for IPv6 Address Text Representation. 195.It RFC 6480 196An Infrastructure to Support Secure Internet Routing. 197.It RFC 6482 198A Profile for Route Origin Authorizations (ROAs). 199.It RFC 6485 200The Profile for Algorithms and Key Sizes for Use in the Resource Public Key 201Infrastructure (RPKI). 202.It RFC 6486 203Manifests for the Resource Public Key Infrastructure (RPKI). 204.It RFC 6487 205A Profile for X.509 PKIX Resource Certificates. 206.It RFC 6488 207Signed Object Template for the Resource Public Key Infrastructure 208(RPKI). 209.It RFC 7730 210Resource Public Key Infrastructure (RPKI) Trust Anchor Locator. 211.El 212.\" .Sh HISTORY 213.Sh AUTHORS 214The 215.Nm 216utility was written by 217.An Kristaps Dzonsons Aq Mt kristaps@bsd.lv . 218.\" .Sh CAVEATS 219.\" .Sh BUGS 220