rov.conf

prefix-list rpki-validators-v4 {
    127.0.0.0/8;
    apply-path "routing-options validation group <*> session <*.*.*.*>";
}
prefix-list rpki-validators-v6 {
    ::1/128;
    apply-path "routing-options validation group <*> session <*:*:*>";
}
 
policy-statement route-validation {    
    term valid {
        from {
            protocol bgp;
            validation-database valid;
        }
        then {
            local-preference add 10;
            validation-state valid;
            accept;
        }
    }
    term invalid {
        from {
            protocol bgp;
            validation-database invalid;
        }
        then {
            local-preference subtract 10;
            validation-state invalid;
            accept;
        }
    }
    term unknown {
        from protocol bgp;
        then {
            validation-state unknown;
            accept;
        }
    }
}
 
validation {
    group rpki-validator {
        session ##VALIDATION_HOST## {
            port ##PORT##;
            local-address ##LOOPBACK##;
        }
    }
}
 
# neighbor import policies, add route-validation
neighbor ##NEIGHBOR## {
    import [ ... route-validation ... ];
}
 
# IPv4 filter
filter loopback-v4 {
    # ...
    term rpki-rtr {
        from {
            source-prefix-list {
                rpki-validators-v4;
            }
            protocol tcp;
            source-port ##PORT##;
        }
        then {
            count rpki-rtr;
            accept;
        }
    }
    # ....
}

# IPv6 filter
filter loopback-v6 {
    # ...
    term rpki-rtr {
        from {
            source-prefix-list {
                rpki-validators-v6;
            }
            payload-protocol tcp;
            source-port ##PORT##;
        }
        then {
            count rpki-rtr;
            accept;
        }
    }
    # ...
}

# NOTE: ROV on Junos opens TCP port 2222, limit access with lo0 filter