Re: [Sidrops] Heads-up, almost all caches are about to follow draft-spaghetti-sidrops-rrdp-same-origin

[Job Snijders <[e-mail]>]

Dear Tom, SIDROPS,

On Fri, Apr 12, 2024 at 09:04:48AM +1000, Tom Harrison wrote:
> On Thu, Apr 11, 2024 at 05:34:09PM +0200, Job Snijders wrote:
> > This is an opportunity for RRDP Publishers and other stakeholders to
> > consider the implications and provide feedback on the problem &
> > choosen solution.
> 
> This appears to be a real problem, and the suggested solution makes
> sense.

Thanks

> The draft notes that "In the past 2.5 years no RRDP Repository Servers
> have employed cross-origin URIs in Update Notification Files".  Was
> there some record of cross-origin URIs being used in that way before
> that time, or is the period here just that for which relevant
> logs/records exist?

Good questions! Thank you for asking.

I based this assertion on data from http://www.rpkiviews.org. To be
precise: the rpki-client process execution log files contained in the
'josephine.sobornost.net' tarball archives. I parsed 68,160 unstructured
log files, dating from 06-Dec-2020 until 13-Apr-2024. Interpreting these
files requires some knowledge of the rpki-client program and its
evolution over the years. The data is there, but might not be trivially
accessible.

An important aspect to the 2.5 year retrospective timeframe is that in
October 2021 Claudio Jeker introduced a 'same-origin policy' check in
rpki-client (this check imposed on RRDP Update Notification File XML
content, but not on HTTP redirects). From an rpkiviews archive log
message parsing perspective, this meant that - from ~ October 2021
onwards, instantiations of 'cross-origin references' were detectable via
an error log message. Additionally, rpki-client always logged HTTP
redirects in 'verbose' mode, so those were captured for some years.

In short, the rpkiviews log files allow to retrospectively assess the
prevalence of cross-origin RRDP references & HTTP redirects in the
ecosystem. Some observations I'd like to share:

Case 1 - HTTP Redirects
=======================

TL;DR - Cross-Origin HTTP redirects are rarely used in practise.

For example, in the period 21-Dec-2022 - March 2024, the Fraunhofer
institute ran (multiple?) experiments, one instance where
https://rpki1.rpki-test.sit.fraunhofer.de/rrdp/notification.xml
redirected to per-request-unique destinations in the form of
https://[RANDOM-UUID].rpki.rpki-test.sit.fraunhofer.de/...  This would
be an example of cross-origin HTTP redirects, and violate the proposed
'same-origin policy', but this repository (as I understand it) exists
for academic purposes. I didn't count that into the "would cause
problems with non-compliance" bucket.

Two other repositories (FQDNs 'chloe.sobornost.net' & 'dev.tw') did or
currently do use redirects on the same FQDN origin, both instances are
compliant with the proposal at hand. 

I didn't see other manifestations of HTTP redirection in the log archive.

Case 2 - RRDP XML Cross-Origin URIs
===================================

TL;DR - Cross-Origin RRDP URI references are rarely used in practise.

As mentioned - in 2021, rpki-client as a validator blocked following
cross-origin URIs when present in RRDP XML. As far as I know this
(non-standard behaviour) hasn't caused any production CA any issues.
But, read on:

>From April 20th, 2022 until May 2nd, 2022 'rpki-rrdp.us-east-2.amazonaws.com'
briefly used cross-origin URIs in its RRDP data. As I understand it
(both from rpkiviews data and having talked to involved staff) this was
their first foray into self-publishing RPKI data. Once AWS staff became
aware that cross-origin URIs in RRDP XML caused an interopability issue
with rpki-client, the URI scheme was adjusted to be 'same origin'. I'm
counting this into the "testing my-first-rpki" bucket.

On July 13th, 2022 - for just a few hours - 'child.rov.koenvanhove.nl'
seemed to use cross-origin URI references. I count this towards the
"existed for academic purposes" bucket.

>From April 9th until 10th, 2023 'rpki.co' seemed to use cross-origin URI
references, might have been part of a migration of sorts. I don't know.

I didn't see other manifestations of cross-origin URIs RRDP in the log
archive.

Closing words
=============

I think a "same-origin policy" in RRDP helps everyone in the ecosystem.

Other vantage points might have different perspectives on HTTP redirects
and RRDP XML content. Should other 'vantage points archiving operators'
conclude very different observations, that would be super interesting to
me, and I'd love to compare notes.

Kind regards,

Job