Skip to content

Commit 53d1593

Browse files
committed
Config: Improve --init-tals
1. Update the TAL URLs. (The old ones were very obsolete.) 2. Add --init-as0-tals. (Used to download the ASN0 TALs.) 3. Deprecate and zero-op --init-locations. (Didn't make sense. If the user needs a different URL, they can do wget instead.) 4. Deprecate setup_fort.sh. (Seems to be redundant. --init-tals already takes care of downloading TALs.)
1 parent 2e42780 commit 53d1593

File tree

8 files changed

+91
-313
lines changed

8 files changed

+91
-313
lines changed

examples/README.md

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,4 +3,3 @@
33
This folder contains the following examples:
44
- `config.json`: configuration file mostly with the default values used by the validator. Can be set as value of [`--configuration-file`](https://nicmx.github.io/FORT-validator/usage.html#--configuration-file).
55
- `demo.slurm`: valid SLURM file mostly with the same values as in [RFC 8416 section 3.5](https://tools.ietf.org/html/rfc8416#section-3.5). Can be set as value of [`--slurm`](https://nicmx.github.io/FORT-validator/usage.html#--slurm).
6-
- `tal/`: directory that contains almost all RIRs TALs, [read more](tal/).

examples/tal/README.md

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,4 @@
1-
# TALs
1+
Please ignore this folder. It only exists in the hopes that `fort_setup.sh` continues working until it's retired. The script is deprecated at the moment.
22

3-
Most of the Trust Anchor Locators of the RIRs are included here for convenience. (But maybe you should get your own, for security.)
3+
The TALs contained here are pretty much all old and obsolete. If you need to download the current TALs, run `fort --init-tals --tal <TAL directory>` instead.
44

5-
**Almost every TAL includes an HTTPS URI to fetch the trust anchor certificates, FORT validator utilizes such URIs by default.**
6-
7-
The only TAL that's not included is ARIN's, because you need to agree to their [RPA](https://www.arin.net/resources/manage/rpki/tal/).
8-
9-
In order to ease the ARIN TAL download, there's a script that does that for you: [fort_setup.sh](../../fort_setup.sh). Read more about it at web docs section [Compilation and Installation](https://nicmx.github.io/FORT-validator/installation.html).

fort_setup.sh

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,12 @@
3030
# - Using the values of the configuration file (uses the args '--tal' and
3131
# '--local-repository').
3232

33+
echo "WARNING: this script (fort_setup.sh) is deprecated, and will be deleted soon."
34+
echo "I don't even know if it works properly."
35+
echo "If you want to download the TALs, use the fort binary's --init-tals option."
36+
echo "See https://nicmx.github.io/FORT-validator/usage.html#--init-tals"
37+
echo "===================================="
38+
3339
exit_on_err()
3440
{
3541
if ! [ $1 ] ; then

src/config.c

Lines changed: 22 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -204,11 +204,12 @@ struct rpki_config {
204204
/* Time period that must lapse to warn about a stale repository */
205205
unsigned int stale_repository_period;
206206

207-
/* Download the TALs into --tal? */
207+
/* Download the normal TALs into --tal? */
208208
bool init_tals;
209-
210-
/* HTTPS URLS from where the TALS will be fetched */
211-
struct init_locations init_tal_locations;
209+
/* Download AS0 TALs into --tal? */
210+
bool init_tal0s;
211+
/* Deprecated; currently does nothing. */
212+
unsigned int init_tal_locations;
212213

213214
/* Thread pools for specific tasks */
214215
struct {
@@ -771,15 +772,21 @@ static const struct option_field options[] = {
771772
.name = "init-tals",
772773
.type = &gt_bool,
773774
.offset = offsetof(struct rpki_config, init_tals),
774-
.doc = "Fetch the RIR's TAL files into the specified path at --tal",
775+
.doc = "Fetch the currently-known TAL files into --tal",
775776
.availability = AVAILABILITY_GETOPT,
776-
},
777-
{
777+
}, {
778+
.id = 11002,
779+
.name = "init-as0-tals",
780+
.type = &gt_bool,
781+
.offset = offsetof(struct rpki_config, init_tal0s),
782+
.doc = "Fetch the currently-known AS0 TAL files into --tal",
783+
.availability = AVAILABILITY_GETOPT,
784+
}, {
778785
.id = 11001,
779786
.name = "init-locations",
780787
.type = &gt_init_tals_locations,
781788
.offset = offsetof(struct rpki_config, init_tal_locations),
782-
.doc = "Locations from where the TAL files will be downloaded, and its optional accept message",
789+
.doc = "Deprecated. Does nothing as of Fort 1.5.1.",
783790
.availability = AVAILABILITY_JSON,
784791
},
785792

@@ -953,18 +960,6 @@ set_default_values(void)
953960
"$LOCAL",
954961
};
955962

956-
static char const *init_locations_no_msg[] = {
957-
"https://raw.githubusercontent.com/NICMx/FORT-validator/master/examples/tal/lacnic.tal",
958-
"https://raw.githubusercontent.com/NICMx/FORT-validator/master/examples/tal/ripe.tal",
959-
"https://raw.githubusercontent.com/NICMx/FORT-validator/master/examples/tal/afrinic.tal",
960-
"https://raw.githubusercontent.com/NICMx/FORT-validator/master/examples/tal/apnic.tal",
961-
};
962-
963-
static char const *init_locations_w_msg[] = {
964-
"https://www.arin.net/resources/manage/rpki/arin.tal",
965-
"Please download and read ARIN Relying Party Agreement (RPA) from https://www.arin.net/resources/manage/rpki/rpa.pdf. Once you've read it and if you agree ARIN RPA, type 'yes' to proceed with ARIN's TAL download:",
966-
};
967-
968963
int error;
969964

970965
/*
@@ -1083,20 +1078,15 @@ set_default_values(void)
10831078
rpki_config.stale_repository_period = 43200; /* 12 hours */
10841079

10851080
rpki_config.init_tals = false;
1086-
error = init_locations_init(&rpki_config.init_tal_locations,
1087-
init_locations_no_msg, ARRAY_LEN(init_locations_no_msg),
1088-
init_locations_w_msg, ARRAY_LEN(init_locations_w_msg));
1089-
if (error)
1090-
goto revert_init_locations;
1081+
rpki_config.init_tal_locations = 0;
10911082

10921083
/* Common scenario is to connect 1 router or a couple of them */
10931084
rpki_config.thread_pool.server.max = 20;
10941085
/* Usually 5 TALs, let a few more available */
10951086
rpki_config.thread_pool.validation.max = 5;
10961087

10971088
return 0;
1098-
revert_init_locations:
1099-
free(rpki_config.validation_log.tag);
1089+
11001090
revert_validation_log_tag:
11011091
free(rpki_config.http.user_agent);
11021092
revert_flat_array:
@@ -1256,9 +1246,11 @@ handle_flags_config(int argc, char **argv)
12561246
goto end;
12571247

12581248
/* If present, nothing else is done */
1259-
if (rpki_config.init_tals) {
1260-
error = init_tals_exec(&rpki_config.init_tal_locations,
1261-
rpki_config.tal);
1249+
if (rpki_config.init_tals || rpki_config.init_tal0s) {
1250+
if (rpki_config.init_tals)
1251+
error = download_tals();
1252+
if (!error && rpki_config.init_tal0s)
1253+
error = download_tal0s();
12621254
free(long_opts);
12631255
free(short_opts);
12641256
exit(error);

src/config/init_tals.c

Lines changed: 1 addition & 222 deletions
Original file line numberDiff line numberDiff line change
@@ -1,234 +1,13 @@
11
#include "config/init_tals.h"
22

3-
#include <getopt.h>
4-
#include <stdlib.h>
5-
#include <string.h>
6-
#include <sys/queue.h>
7-
#include "log.h"
8-
9-
#define JSON_MEMBER_URL "url"
10-
#define JSON_MEMBER_MESSAGE "accept-message"
11-
12-
static int
13-
init_location_create(char const *url, struct init_location **result)
14-
{
15-
struct init_location *tmp;
16-
17-
tmp = malloc(sizeof(struct init_location));
18-
if (tmp == NULL)
19-
return pr_enomem();
20-
21-
tmp->url = strdup(url);
22-
if (tmp->url == NULL) {
23-
free(tmp);
24-
return pr_enomem();
25-
}
26-
27-
tmp->accept_message = NULL;
28-
29-
*result = tmp;
30-
return 0;
31-
}
32-
33-
static void
34-
init_location_destroy(struct init_location *location)
35-
{
36-
if (location->accept_message != NULL)
37-
free(location->accept_message);
38-
free(location->url);
39-
free(location);
40-
}
41-
42-
void
43-
init_locations_cleanup(struct init_locations *locations)
44-
{
45-
struct init_location *tmp;
46-
47-
while (!SLIST_EMPTY(locations)) {
48-
tmp = locations->slh_first;
49-
SLIST_REMOVE_HEAD(locations, next);
50-
init_location_destroy(tmp);
51-
}
52-
}
53-
54-
void
55-
__init_locations_cleanup(void *arg)
56-
{
57-
init_locations_cleanup(arg);
58-
}
59-
60-
static int
61-
init_locations_add_n_msg(struct init_locations *locations, char const *url)
62-
{
63-
struct init_location *tmp;
64-
int error;
65-
66-
tmp = NULL;
67-
error = init_location_create(url, &tmp);
68-
if (error)
69-
return error;
70-
71-
SLIST_INSERT_HEAD(locations, tmp, next);
72-
return 0;
73-
}
74-
75-
static int
76-
init_locations_add_w_msg(struct init_locations *locations, char const *url,
77-
char const *message)
78-
{
79-
struct init_location *tmp;
80-
int error;
81-
82-
tmp = NULL;
83-
error = init_location_create(url, &tmp);
84-
if (error)
85-
return error;
86-
87-
tmp->accept_message = strdup(message);
88-
if (tmp->accept_message == NULL) {
89-
init_location_destroy(tmp);
90-
return pr_enomem();
91-
}
92-
93-
SLIST_INSERT_HEAD(locations, tmp, next);
94-
return 0;
95-
}
96-
97-
int
98-
init_locations_init(struct init_locations *locations,
99-
char const *const *non_message, size_t non_message_len,
100-
char const *const *with_message, size_t with_message_len)
101-
{
102-
size_t i;
103-
int error;
104-
105-
SLIST_INIT(locations);
106-
107-
for (i = 0; i < non_message_len; i++) {
108-
error = init_locations_add_n_msg(locations, non_message[i]);
109-
if (error)
110-
goto cleanup;
111-
}
112-
113-
for (i = 0; i < with_message_len; i+=2) {
114-
error = init_locations_add_w_msg(locations, with_message[i],
115-
with_message[i + 1]);
116-
if (error)
117-
goto cleanup;
118-
}
119-
120-
return 0;
121-
cleanup:
122-
init_locations_cleanup(locations);
123-
return error;
124-
}
125-
126-
int
127-
init_locations_foreach(struct init_locations *locations,
128-
init_locations_foreach_cb cb, void *arg)
129-
{
130-
struct init_location *ptr;
131-
int error;
132-
133-
SLIST_FOREACH(ptr, locations, next) {
134-
error = cb(ptr->url, ptr->accept_message, arg);
135-
if (error)
136-
return error;
137-
}
138-
139-
return 0;
140-
}
141-
142-
static int
143-
parse_location(char const *name, size_t pos, json_t *json, char const **url,
144-
char const **message)
145-
{
146-
json_t *member;
147-
148-
member = json_object_get(json, JSON_MEMBER_URL);
149-
if (member == NULL)
150-
return pr_op_err("'%s' array element #%zu requires the member '%s'.",
151-
name, pos, JSON_MEMBER_URL);
152-
153-
if (!json_is_string(member))
154-
return pr_op_err("'%s' array element #%zu '%s' member must be a string",
155-
name, pos, JSON_MEMBER_URL);
156-
157-
*url = json_string_value(member);
158-
159-
/* Optional */
160-
member = json_object_get(json, JSON_MEMBER_MESSAGE);
161-
if (member == NULL) {
162-
*message = NULL;
163-
return 0;
164-
}
165-
166-
if (!json_is_string(member))
167-
return pr_op_err("'%s' array element #%zu '%s' member must be a string",
168-
name, pos, JSON_MEMBER_MESSAGE);
169-
170-
*message = json_string_value(member);
171-
172-
return 0;
173-
}
174-
1753
static int
1764
init_tals_parse_json(struct option_field const *opt, json_t *json, void *result)
1775
{
178-
struct init_locations *ptr;
179-
json_t *elem;
180-
size_t len;
181-
size_t i;
182-
char const *url;
183-
char const *message;
184-
int error;
185-
186-
if (!json_is_array(json)) {
187-
return pr_op_err("The '%s' element is not a JSON array",
188-
opt->name);
189-
}
190-
191-
len = json_array_size(json);
192-
193-
if (len == 0) {
194-
/* Cleanup default value */
195-
init_locations_cleanup(result);
196-
return 0;
197-
}
198-
199-
ptr = result;
200-
201-
/* Remove the previous value (usually the default). */
202-
init_locations_cleanup(ptr);
203-
204-
for (i = 0; i < len; i++) {
205-
elem = json_array_get(json, i);
206-
if (!json_is_object(elem))
207-
return pr_op_err("'%s' array element #%zu is not an object",
208-
opt->name, i);
209-
210-
url = NULL;
211-
message = NULL;
212-
error = parse_location(opt->name, i, elem, &url, &message);
213-
if (error)
214-
goto cleanup;
215-
216-
if (message == NULL)
217-
error = init_locations_add_n_msg(ptr, url);
218-
else
219-
error = init_locations_add_w_msg(ptr, url, message);
220-
221-
if (error)
222-
goto cleanup;
223-
}
6+
/* This is deprecated. Please delete it in the future. */
2247
return 0;
225-
cleanup:
226-
init_locations_cleanup(ptr);
227-
return error;
2288
}
2299

23010
const struct global_type gt_init_tals_locations = {
23111
.print = NULL,
23212
.parse.json = init_tals_parse_json,
233-
.free = __init_locations_cleanup,
23413
};

src/config/init_tals.h

Lines changed: 0 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,8 @@
11
#ifndef SRC_CONFIG_INIT_TALS_H_
22
#define SRC_CONFIG_INIT_TALS_H_
33

4-
#include <stddef.h>
5-
#include <sys/queue.h>
64
#include "config/types.h"
75

8-
/* Struct where each URL and its optional message are stored */
9-
struct init_location {
10-
char *url;
11-
char *accept_message;
12-
SLIST_ENTRY(init_location) next;
13-
};
14-
15-
SLIST_HEAD(init_locations, init_location);
16-
176
extern const struct global_type gt_init_tals_locations;
187

19-
typedef int (*init_locations_foreach_cb)(char const *, char const *, void *);
20-
int init_locations_foreach(struct init_locations *, init_locations_foreach_cb,
21-
void *);
22-
23-
int init_locations_init(struct init_locations *, char const *const *, size_t,
24-
char const *const *, size_t);
25-
void init_locations_cleanup(struct init_locations *);
26-
278
#endif /* SRC_CONFIG_INIT_TALS_H_ */

0 commit comments

Comments
 (0)