Re: [Sidrops] [WG ADOPTION] Adoption call: draft-timbru-sidrops-publication-server-bcp - ENDS 02/08/2024

[Claudio Jeker <[e-mail]>]

On Tue, Feb 06, 2024 at 06:38:30PM +0100, Job Snijders wrote:
> Dear all,
> 
> On the topic of the publication best practises, it might be good to
> strongly recommend that RRDP notification file, delta files, and
> snapshot file all be hosted on the same FQDN. But, AFAIK, the RRDP
> specification doesn't actually require this.
> 
> This 'same origin' check was added back in 2021 to rpki-client to guard
> against notification files pointing to giant files on open source
> mirrors or towards other people's (large) RRDP snapshots.
> 
> Since 2021, the global RPKI publication ecosystem appears to naturally
> comply with this informal expectation, as in, the check doesn't appear
> to cause friction.
> 
> Thoughts?

I strongly agree that all RRDP files MUST be served from the same FQDN.
As you mentioned rpki-client already enforces this and I would use
language much stronger than "strongly recommend" for this.
The RRDP specification should have used relative path names in the
notification.xml file but that ship has sailed.

Allowing cross-origin URI in notification.xml is just asking for trouble.
-- 
:wq Claudio