Subject: [Sidrops] rpki-client 7.4: limits on objects and RRDP constraint

From: Job Snijders <[email-masked]>
Date: Sat, 30 Oct 2021 21:25:29 +0200

Hi everyone,

The rpki-client team decided to add a few arbitrary limits and impose a
constraint on RRDP in version 7.4

>From our testing and guesswork these limits do not pose an issue for any
current CA or RIR Repository, and also allow for sufficient growth for
the forseeable future.

RRDP specification deviation:

    RRDP Snapshot and Delta files MUST be hosted on the same host as the
    notification file. The consequence is that Repository operators no
    longer are permitted to host the Notification XML on a different host
    than the deltas/snapshots it references. All current CAs appear to abide
    to this constraint.

Simple numerical limits:

    * Manifests referencing more than 100,000 FileAndHash are invalid
    * rsync won't download any files larger than 2 megabyte
    * Signed Objects larger than 2 megabytes are considered invalid
    * RRDP snapshot files larger than 2 gigabyte are discarded
    * RRDP delta files larger than 2 gigabyte are discarded
    * RRDP notification files larger than 2 gigabyte are discarded
    * Subject Information Access URIs cannot be longer than 2048 bytes
    * RFC 3779 extension containing more than 200,000 IP entries are invalid
    * RFC 3779 extension containing more than 200,000 AS entries are invalid

Full release notes here: https://marc.info/?l=openbsd-announce&m=163561569932494&w=2

We welcome feedback from the broader community. Thanks to all of the
contributors who helped make this release possible.

Kind regards,

Job