Network Working Group S. Bortzmeyer Internet-Draft AFNIC Intended status: Standards Track March 19, 2018 Expires: September 20, 2018 EPP Mapping for DNAME delegation of domain names draft-bortzmeyer-regext-epp-dname-02 Abstract This document describes an Extensible Provisioning Protocol (EPP) extension mapping for the provisioning and management of Domain Name System for domain names stored in a shared central repository. Specified in XML, this mapping extends the EPP domain name mapping to provide the ability to delegate a domain names through DNAME resource records, thus making the new domain an alias of a previous domain. REMOVE BEFORE PUBLICATION This document should be discussed on the Registration Protocols Extensions (regext) mailing list. The source of this document is kept on a Gitlab at Framagit [1]. A list of open issues is there as well [2]. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on September 20, 2018. Copyright Notice Copyright (c) 2018 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of Bortzmeyer Expires September 20, 2018 [Page 1] Internet-Draft EPP Mapping for DNAME delegation March 2018 publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 1.1. Conventions Used in This Document . . . . . . . . . . . . 3 2. Object Attributes . . . . . . . . . . . . . . . . . . . . . . 3 3. Presentation . . . . . . . . . . . . . . . . . . . . . . . . 4 4. Examples . . . . . . . . . . . . . . . . . . . . . . . . . . 4 5. EPP Command Mapping . . . . . . . . . . . . . . . . . . . . . 4 5.1. EPP Query Commands . . . . . . . . . . . . . . . . . . . 4 5.1.1. EPP Command . . . . . . . . . . . . . . . . . 5 5.1.2. EPP Command . . . . . . . . . . . . . . . . . 5 5.2. EPP Command . . . . . . . . . . . . . . . . . 7 6. EPP Transform Commands . . . . . . . . . . . . . . . . . . . 7 6.1. EPP Command . . . . . . . . . . . . . . . . . . 7 6.2. EPP Command . . . . . . . . . . . . . . . . . . 8 6.3. EPP Command . . . . . . . . . . . . . . . . . . . 8 6.4. EPP Command . . . . . . . . . . . . . . . . . 8 6.5. EPP Command . . . . . . . . . . . . . . . . . . 9 7. Formal Syntax . . . . . . . . . . . . . . . . . . . . . . . . 10 8. Internationalization Considerations . . . . . . . . . . . . . 10 9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 11 10. Security Considerations . . . . . . . . . . . . . . . . . . . 11 11. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 12 12. References . . . . . . . . . . . . . . . . . . . . . . . . . 12 12.1. Normative References . . . . . . . . . . . . . . . . . . 12 12.2. Informative References . . . . . . . . . . . . . . . . . 13 12.3. URIs . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Appendix A. Generic Resource Records type . . . . . . . . . . . 15 Appendix B. Implementation status . . . . . . . . . . . . . . . 15 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 15 1. Introduction This document describes an extension mapping for version 1.0 of the Extensible Provisioning Protocol (EPP) described in RFC 5730 [RFC5730]. This mapping, an extension of the domain name mapping described in RFC 5731 [RFC5731], is specified using the Extensible Markup Language (XML) 1.0 [W3C.REC-xml-20001006] and XML Schema notation ([W3C.REC-xmlschema-1-20041028] [W3C.REC-xmlschema-2-20041028]). Bortzmeyer Expires September 20, 2018 [Page 2] Internet-Draft EPP Mapping for DNAME delegation March 2018 The EPP core protocol specification [RFC5730] provides a complete description of EPP command and response structures. A thorough understanding of the base protocol specification is necessary to understand the mapping described in this document. Familiarity with the Domain Name System (DNS) described in RFC 1034 [RFC1034] and RFC 1035 [RFC1035] and with the DNS DNAME Resource Record type described in RFC 6672 [RFC6672] is required to understand the DNS concepts described in this document. (DNAME have properties that may be surprising at first; for instance, it aliases only the subdomains, not the owner name of the DNAME record itself.) The EPP mapping described in this document specifies a mechanism for the provisioning and management of domain names in a shared central repository. Today, most registries allow only delegation of domain names to name servers specified in NS resource records. DNAME [RFC6672] allow another type of delegation, which can be useful for instance for the new AS 112 [RFC7535], as proposed in [I-D.bortzmeyer-dname-root]. Information exchanged via this mapping can be extracted from the repository and used to publish DNAME resource records. 1.1. Conventions Used in This Document The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14, RFC 2119 [RFC2119]. In examples, "C:" represents lines sent by a protocol client, and "S:" represents lines returned by a protocol server. "////" is used to note element values that have been shortened to better fit page boundaries. Indentation and white space in examples is provided only to illustrate element relationships and is not a mandatory feature of this protocol. XML is case sensitive. Unless stated otherwise, XML specifications and examples provided in this document MUST be interpreted in the character case presented in order to develop a conforming implementation. dnameDeleg-1.0 is used as an abbreviation for urn:ietf:params:xml:ns:dnameDeleg-1.0. 2. Object Attributes This extension adds additional elements to the EPP domain name mapping [RFC5731]. Only those new elements are described here. Bortzmeyer Expires September 20, 2018 [Page 3] Internet-Draft EPP Mapping for DNAME delegation March 2018 DNAME information is published by a DNS server to indicate that a child zone is actually an alias of another zone. A DNAME resource record (RR) contains a single field named target. See RFC 6672 [RFC6672] for the specific field format. 3. Presentation It is the server policy to allow DNAME delegations or not. It is also the server policy to allow (or not) a domain to switch between these two types of delegation with a EPP . The interface relies on the use of the element for creates, adds, removes, and responses. The data is provided by the client. If the DNAME target is in a zone managed by the server, the server operator MAY checks its existence in its database and the fact that it is not itself a DNAME. Otherwise, the server operator MAY issue out-of-band DNS queries to check if the target really exists. The element contains a domain name, as described in Section 2.1 of RFC 6672 [RFC6672]. The value of the element is represented as a eppcom:labelType ([RFC5730], section 4.4, and [W3C.REC-xmlschema-2-20041028]). 4. Examples Example use of the dnameDeleg:dnameTarget, for instance for an EPP : foo.bar.example 5. EPP Command Mapping A detailed description of the EPP syntax and semantics can be found in the EPP core protocol specification [RFC5730]. The command mappings described here are specifically for use in provisioning and managing DNAME delegations via EPP. 5.1. EPP Query Commands EPP provides three commands to retrieve object information: to determine if an object is known to the server, to retrieve detailed information associated with an object, and to retrieve object transfer status information. Bortzmeyer Expires September 20, 2018 [Page 4] Internet-Draft EPP Mapping for DNAME delegation March 2018 5.1.1. EPP Command This extension does not add any elements to the EPP command or response described in the EPP domain mapping [RFC5731]. Note that an EPP client cannot use to find out if a server authorizes DNAME delegation for this specific domain (EPP login information is not sufficient because the fact that the server supports the extension does not mean it is authorized for all names.) [REMOVE BEFORE PUBLICATION: issue #3 discussed the case.] 5.1.2. EPP Command This extension does not add any elements to the EPP command described in the EPP domain mapping [RFC5731]. [REMOVE BEFORE PUBLICATION: issue #6 discussed whether or not it would be a good idea.] However, additional elements are defined for the response. When an command has been processed successfully, the EPP element MUST contain child elements as described in the EPP domain mapping [RFC5731]. In addition, the EPP element SHOULD contain a child element that identifies the extension namespace if the domain object has data associated with this extension, based on server policy and depending on support of the client for dnameDeleg, based on the EPP login services it provided. The element contains a domain name as its value. A server MUST NOT return both a and a ([RFC5731], section 3.1.2). Bortzmeyer Expires September 20, 2018 [Page 5] Internet-Draft EPP Mapping for DNAME delegation March 2018 Example Response S: S: S: S: S: Command completed successfully S: S: S: S: example.com S: EXAMPLE1-REP S: S: jd1234 S: sh8013 S: sh8013 S: ClientX S: ClientY S: 1999-04-03T22:00:00.0Z S: ClientX S: 1999-12-03T09:00:00.0Z S: 2005-04-03T22:00:00.0Z S: 2000-04-08T09:00:00.0Z S: S: 2fooBAR S: S: S: S: S: S: foo.bar.example S: S: S: S: ABC-12345 S: 54322-XYZ S: S: S: An EPP error response MUST be returned if an command cannot be processed for any reason. Bortzmeyer Expires September 20, 2018 [Page 6] Internet-Draft EPP Mapping for DNAME delegation March 2018 5.2. EPP Command This extension does not add any elements to the EPP command or response described in the EPP domain mapping [RFC5731]. A domain cannot be switched from NS delegation to DNAME delegation (or vice-versa) through a transfer. Note that this may be one additional reason for a transfer to fail: if the gaining registrar does not support DNAME delegation. The server MUST return error code 2106. 6. EPP Transform Commands EPP provides five commands to transform objects: to create an instance of an object, to delete an instance of an object, to extend the validity period of an object, to manage object sponsorship changes, and to change information associated with an object. 6.1. EPP Command This extension defines an additional element for the EPP command described in the EPP domain mapping [RFC5731]. No additional elements are defined for the EPP response. The EPP command provides a transform operation that allows a client to create a domain object. In addition to the EPP command elements described in the EPP domain mapping [RFC5731], the command MUST contain an element, and the element MUST contain a child element that identifies the extension namespace if the client wants to associate data defined in this extension to the domain object. The has a domain name as value. A client MUST NOT send both a and elements. TODO See issue #4 for the choice of the error code(s). Bortzmeyer Expires September 20, 2018 [Page 7] Internet-Draft EPP Mapping for DNAME delegation March 2018 Example Command: C: C: C: C: C: C: example.com C: 2 C: jd1234 C: sh8013 C: sh8013 C: C: 2fooBAR C: C: C: C: C: foo.bar.example C: C: ABC-12345 C: C: When a command has been processed successfully, the EPP response is as described in the EPP domain mapping [RFC5731]. 6.2. EPP Command This extension does not add any elements to the EPP command or response described in the EPP domain mapping [RFC5731]. 6.3. EPP Command This extension does not add any elements to the EPP command or response described in the EPP domain mapping [RFC5731]. 6.4. EPP Command This extension does not add any elements to the EPP command or response described in the EPP domain mapping [RFC5731]. Bortzmeyer Expires September 20, 2018 [Page 8] Internet-Draft EPP Mapping for DNAME delegation March 2018 6.5. EPP Command This extension defines additional elements for the EPP command described in the EPP domain mapping [RFC5731]. No additional elements are defined for the EPP response. The EPP command provides a transform operation that allows a client to modify the attributes of a domain object. In addition to the EPP command elements described in the EPP domain mapping, the command MUST contain an element, and the element MUST contain a child element that identifies the extension namespace if the client wants to update the domain object with data defined in this extension. The element has a domain name as its value. If present, it updates the DNAME delegation to the new target, if the domain was already DNAME-delegated, or it switches the domain to a DNAME delegation, if it was previously a NS delegation. A server MAY refuse such a switch, per its policy. In the same way, a RFC 5731 [RFC5731] update with NS information, without the extension decribed here, switches to NS delegation if the domain was previously DNAME- delegated. TODO there is an issue with the switch from NS to DNAME delegation if the domain had in-bailiwick name servers. See issue #7. Example Command, Adding and Removing: C: C: C: C: C: C: example.com C: C: C: C: foo.bar.example C: C: C: ABC-12345 C: C: When an extended command has been processed successfully, the EPP response is as described in the EPP domain mapping [RFC5731]. Bortzmeyer Expires September 20, 2018 [Page 9] Internet-Draft EPP Mapping for DNAME delegation March 2018 7. Formal Syntax An EPP object mapping is specified in XML Schema notation. The formal syntax presented here is a complete schema representation of the object mapping suitable for automated validation of EPP XML instances. The BEGIN and END tags are not part of the schema; they are used to note the beginning and ending of the schema for URI registration purposes. BEGIN Extensible Provisioning Protocol v1.0 domain name extension schema for provisioning DNAME domain names. END 8. Internationalization Considerations EPP is represented in XML, which provides native support for encoding information using the Unicode character set and its more compact representations including UTF-8 [RFC3629]. Conformant XML processors recognize both UTF-8 and UTF-16 [RFC2781]. Though XML includes provisions to identify and use other character encodings through use of an "encoding" attribute in an declaration, use of UTF-8 is RECOMMENDED in environments where parser encoding support incompatibility exists. As an extension of the EPP domain mapping [RFC5731], the internationalization requirements in the EPP domain mapping [RFC5731] Bortzmeyer Expires September 20, 2018 [Page 10] Internet-Draft EPP Mapping for DNAME delegation March 2018 are followed by this extension. This extension does not override any of the EPP domain mapping [RFC5731] internationalization features. 9. IANA Considerations This document uses URNs to describe XML namespaces and XML schemas conforming to a registry mechanism described in RFC 3688 [RFC3688]. Two URI assignments have been completed by the IANA. Registration request for the extension namespace: URI: urn:ietf:params:xml:ns:dnameDeleg-1.0 Registrant Contact: IESG XML: None. Namespace URIs do not represent an XML specification. Registration request for the extension XML schema: URI: urn:ietf:params:xml:schema:dnameDeleg-1.0 Registrant Contact: IESG XML: See the "Formal Syntax" section of this document. 10. Security Considerations The mapping extensions described in this document do not provide any security services beyond those described by EPP [RFC5730], the EPP domain name mapping [RFC5731], and protocol layers used by EPP. The security considerations described in these other specifications apply to this specification as well. As with other domain object transforms, the EPP transform operations described in this document MUST be restricted to the sponsoring client as authenticated using the mechanisms described in Sections 2.9.1.1 and 7 of RFC 5730 [RFC5730]. Any attempt to perform a transform operation on a domain object by any client other than the sponsoring client MUST be rejected with an appropriate EPP authorization error. The provisioning service described in this document involves the exchange of information that can have an operational impact on the DNS. A trust relationship MUST exist between the EPP client and server, and provisioning of DNAME delegation MUST only be done after the identities of both parties have been confirmed using a strong authentication mechanism. This is just a repeat of [RFC5734], section 8. Bortzmeyer Expires September 20, 2018 [Page 11] Internet-Draft EPP Mapping for DNAME delegation March 2018 An EPP client might be acting as an agent for a zone administrator who wants to send DNAME delegation information to be published by the server operator. Man-in-the-middle attacks are thus possible as a result of direct client activity or inadvertent client data manipulation. 11. Acknowledgements Most of the text has been copied from [RFC5910], so thanks to its authors. Thanks to James Gould for a detailed review and for John Levine and Patrick Mevzek for good remarks. Thanks to Patrick Mevzek for the first implementation. 12. References 12.1. Normative References [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, . [RFC3688] Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688, DOI 10.17487/RFC3688, January 2004, . [RFC5730] Hollenbeck, S., "Extensible Provisioning Protocol (EPP)", STD 69, RFC 5730, DOI 10.17487/RFC5730, August 2009, . [RFC5731] Hollenbeck, S., "Extensible Provisioning Protocol (EPP) Domain Name Mapping", STD 69, RFC 5731, DOI 10.17487/RFC5731, August 2009, . [RFC6672] Rose, S. and W. Wijngaards, "DNAME Redirection in the DNS", RFC 6672, DOI 10.17487/RFC6672, June 2012, . [W3C.REC-xml-20001006] Bray, T., Paoli, J., Sperberg-McQueen, M., and E. Maler, "Extensible Markup Language (XML) 1.0 (Second Edition)", World Wide Web Consortium Recommendation REC-xml-20001006, October 2000, . Bortzmeyer Expires September 20, 2018 [Page 12] Internet-Draft EPP Mapping for DNAME delegation March 2018 [W3C.REC-xmlschema-1-20041028] Thompson, H., Beech, D., Maloney, M., and N. Mendelsohn, "XML Schema Part 1: Structures Second Edition", World Wide Web Consortium Recommendation REC-xmlschema-1-20041028, October 2004, . [W3C.REC-xmlschema-2-20041028] Biron, P. and A. Malhotra, "XML Schema Part 2: Datatypes Second Edition", World Wide Web Consortium Recommendation REC-xmlschema-2-20041028, October 2004, . 12.2. Informative References [I-D.bortzmeyer-dname-root] Bortzmeyer, S., "Using DNAME in the DNS root zone for sinking of special-use TLDs", draft-bortzmeyer-dname- root-05 (work in progress), January 2018. [I-D.hildebrand-deth] Hildebrand, J. and P. Hoffman, "DNS Editing Through HTTPS (DETH)", draft-hildebrand-deth-00 (work in progress), March 2016. [RFC1034] Mockapetris, P., "Domain names - concepts and facilities", STD 13, RFC 1034, DOI 10.17487/RFC1034, November 1987, . [RFC1035] Mockapetris, P., "Domain names - implementation and specification", STD 13, RFC 1035, DOI 10.17487/RFC1035, November 1987, . [RFC2781] Hoffman, P. and F. Yergeau, "UTF-16, an encoding of ISO 10646", RFC 2781, DOI 10.17487/RFC2781, February 2000, . [RFC3629] Yergeau, F., "UTF-8, a transformation format of ISO 10646", STD 63, RFC 3629, DOI 10.17487/RFC3629, November 2003, . [RFC5734] Hollenbeck, S., "Extensible Provisioning Protocol (EPP) Transport over TCP", STD 69, RFC 5734, DOI 10.17487/RFC5734, August 2009, . Bortzmeyer Expires September 20, 2018 [Page 13] Internet-Draft EPP Mapping for DNAME delegation March 2018 [RFC5910] Gould, J. and S. Hollenbeck, "Domain Name System (DNS) Security Extensions Mapping for the Extensible Provisioning Protocol (EPP)", RFC 5910, DOI 10.17487/RFC5910, May 2010, . [RFC7535] Abley, J., Dickson, B., Kumari, W., and G. Michaelson, "AS112 Redirection Using DNAME", RFC 7535, DOI 10.17487/RFC7535, May 2015, . [RFC7942] Sheffer, Y. and A. Farrel, "Improving Awareness of Running Code: The Implementation Status Section", BCP 205, RFC 7942, DOI 10.17487/RFC7942, July 2016, . 12.3. URIs [1] https://framagit.org/bortzmeyer/ietf-epp-dname [2] https://framagit.org/bortzmeyer/ietf-epp-dname/issues [3] https://metacpan.org/pod/Net::DRI [4] https://metacpan.org/source/PMEVZEK/Net-DRI- 0.96_10/lib/Net/DRI/Protocol/EPP/Extensions/DNAME.pm Bortzmeyer Expires September 20, 2018 [Page 14] Internet-Draft EPP Mapping for DNAME delegation March 2018 Appendix A. Generic Resource Records type The goal of this document is not to allow arbitrary DNS Resource record types (such as TXT or LOC). Such a mapping would require the ability to add, update and remove individual records, but it would allow the EPP server to implement a "delegation-less" registry. An example of such attempt to define a standard protocol for provisioning a lot of resource record types is [I-D.hildebrand-deth]. But we don't follow that path. Instead, we keep the idea that the EPP server registers only delegations, either through NS records or, as here, a DNAME record. This keeps the mapping much simpler. For this reason, the possibility to add other resource records together with the DNAME ([RFC6672], section 2.4) is out-of-scope here. Appendix B. Implementation status RFC-EDITOR: REMOVE BEFORE PUBLICATION This section records the status of known implementations of the protocol defined by this specification at the time of posting of this Internet-Draft, and is based on a proposal described in [RFC7942]. The description of implementations in this section is intended to assist the IETF in its decision processes in progressing drafts to RFCs. Please note that the listing of any individual implementation here does not imply endorsement by the IETF. Furthermore, no effort has been spent to verify the information presented here that was supplied by IETF contributors. This is not intended as, and must not be construed to be, a catalog of available implementations or their features. Readers are advised to note that other implementations may exist. According to [RFC7942], "this will allow reviewers and working groups to assign due consideration to documents that have the benefit of running code, which may serve as evidence of valuable experimentation and feedback that have made the implemented protocols more mature. It is up to the individual working groups to use this information as they see fit". This EPP extension is implemented in the Net::DRI EPP client [3], written in Perl. The specific part of Net::DRI is DNAME.pm [4]. Author's Address Bortzmeyer Expires September 20, 2018 [Page 15] Internet-Draft EPP Mapping for DNAME delegation March 2018 Stephane Bortzmeyer AFNIC 1, rue Stephenson Montigny-le-Bretonneux 78180 France Phone: +33 1 39 30 83 46 EMail: bortzmeyer+ietf@nic.fr URI: http://www.afnic.fr/ Bortzmeyer Expires September 20, 2018 [Page 16]