Re: [Sidrops] [WG ADOPTION] Adoption call: draft-timbru-sidrops-publication-server-bcp - ENDS 02/08/2024

[Job Snijders <[e-mail]>]

On Wed, Feb 07, 2024 at 06:01:04PM +0100, Lukas Tribus wrote:
> Maybe only slightly related, but any thoughts on using multiple CDN's ?
> 
> In a TAL file we specify a https and a rsync destination, can multiple
> https destinations be specified?
> 
> Like:
> https://rpki.ripecdn1.net/ta/ripe-ncc-ta.cer
> https://rpki.ripecdn2.net/ta/ripe-ncc-ta.cer
> https://rpki.ripecdn3.net/ta/ripe-ncc-ta.cer
> rsync://rpki.ripe.net/ta/ripe-ncc-ta.cer
> 
> I'd guess that using one FQDN/TLD per CDN would be simpler (cheaper)
> to implement (for the PP) as opposed to a "same FQDN/TLD multi-CDN"
> setup, but it sounds like it would not actually work today?

The TAL file is used at a stage before the RRDP protocol comes into
play. The HTTPS/rsync URLs in a TAL point to a 1 kilobyte file (the
Trust Anchor certificate). RFC 8630 section 2.2 permits one or more
URIs. The example you offered is valid syntax in the TAL file format.

The TA operator can use one or more A / AAAA DNS entries to distribute
the load across multiple endpoints. An example:

    $ grep https /etc/rpki/arin.tal
    https://rrdp.arin.net/arin-rpki-ta.cer

    $ dig A rrdp.arin.net +short
    199.71.0.149
    199.5.26.149
    199.212.0.149

    $ dig AAAA rrdp.arin.net +short
    2001:500:31::149
    2001:500:13::149
    2001:500:a9::149

RRDP can come into play when this self-signed Trust Anchor is
downloaded, parsed and validated:

$ openssl x509 -in arin-rpki-ta.cer -inform DER -text -noout \
  | grep -A3 'Subject Information Access'
            Subject Information Access:
                CA Repository - URI:rsync://rpki.arin.net/repository/arin-rpki-ta/
                RPKI Manifest - URI:rsync://rpki.arin.net/repository/arin-rpki-ta/arin-rpki-ta.mft
                RPKI Notify - URI:https://rrdp.arin.net/notification.xml

The 'RPKI Notify' accessMethod (id-ad-rpkiNotify) is the entrypoint into
RRDP. This element points to the RRDP Notification file.

RFC 8182 section 3.2 permits only once instance of id-ad-rpkiNotify. So
within the current RRDP specification, multiple different FQDNs /
multiple RRDP Notification files can't be done.

Kind regards,

Job