Same-Origin Policy for the RPKI Repository Delta Protocol (RRDP)
updates
- rfc-8182 — The RPKI Repository Delta Protocol (RRDP)
Extracted elements (12)
An alternative to the SOP requirement would be for a future version of RRDP to use relative URIs instead of absolute URIs, which would inherently prevent cross-origin references. The SOP approach was chosen as an update to the existing RFC 8182 rather than requiring a new RRDP version.
The original RRDP specification (RFC 8182) did not explicitly disallow cross-origin URI references from the Update Notification file towards Delta and Snapshot files, and was silent on HTTP Redirection. This oversight allowed one Repository Server to reference RRDP resources on another, inappropriately increasing resource consumption for both RRDP clients and the referenced server.
Analysis of rpkiviews archives from April to September 2024 found only one RRDP server (among the five RIR TALs) that employed a same-origin HTTP redirect, and no RRDP Repository Servers observed to employ cross-origin URIs in Update Notification Files during October 2021–October 2024. Imposing the SOP requirement therefore does not cause any commonly used RRDP Repository Server operations to become non-compliant.
Implementations SHOULD log a message when cross-origin redirects are detected during RRDP session processing.
RRDP Repository Servers and Clients MUST apply a Same-Origin Policy to both the URIs referenced in an Update Notification File and any HTTP Redirects.
The Relying Party MUST NOT follow HTTP Redirection that results from attempts to download Update Notification, Delta, and Snapshot files if the target origin differs from the origin of the Update Notification File. If this verification fails, the RRDP session MUST be rejected.
The Relying Party MUST verify whether the 'uri' attributes in the Update Notification File are of the same origin as the Update Notification File itself. If verification fails, the file MUST be rejected and RRDP cannot be used.
The Repository Server MUST NOT respond with HTTP Redirects towards locations with an origin different from the origin of the Update Notification File specified in the referring RRDP SIA AccessDescription.
The 'uri' attribute in the snapshot element and optional delta elements MUST be part of the same origin as the Update Notification File, meaning referenced URIs MUST have the same scheme, host, and port as the URI for the Update Notification File specified in the referring RRDP SIA AccessDescription.
Same-origin is defined as URIs sharing the same scheme, host, and port — following the Web Origin Concept of RFC 6454. This definition applies to the Update Notification File URI and all referenced Delta and Snapshot URIs.
The RRDP Update Notification File contains 'uri' attributes in snapshot and optional delta elements. These URIs are now required to be same-origin with the Update Notification File's own URI as specified in the RRDP SIA AccessDescription.
Cross-origin requests in RRDP are detrimental because they allow one repository operator to increase resource consumption for other repository operators and RRDP clients. An adversary could also employ cross-origin HTTP Redirects towards other Repository Servers to cause similar undesirable behavior.