idnits 2.17.1 draft-blanchet-regext-rdap-deployfindings-02.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- ** The document seems to lack a both a reference to RFC 2119 and the recommended RFC 2119 boilerplate, even if it appears to use RFC 2119 keywords. RFC 2119 keyword, line 191: '... says "it is RECOMMENDED that server...' RFC 2119 keyword, line 374: '... [RFC7484] section 3 says: "Base RDAP URLs MUST have a trailing "/"...' Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (June 4, 2019) is 1787 days in the past. Is this intentional? Checking references for intended status: Informational ---------------------------------------------------------------------------- -- Looks like a reference, but probably isn't: '1' on line 437 -- Looks like a reference, but probably isn't: '2' on line 440 -- Looks like a reference, but probably isn't: '3' on line 443 -- Looks like a reference, but probably isn't: '4' on line 446 == Missing Reference: 'RFC1166' is mentioned on line 357, but not defined == Missing Reference: 'RFC5952' is mentioned on line 357, but not defined ** Obsolete normative reference: RFC 7482 (Obsoleted by RFC 9082) ** Obsolete normative reference: RFC 7483 (Obsoleted by RFC 9083) ** Obsolete normative reference: RFC 7484 (Obsoleted by RFC 9224) -- Obsolete informational reference (is this intentional?): RFC 5988 (Obsoleted by RFC 8288) Summary: 4 errors (**), 0 flaws (~~), 3 warnings (==), 6 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 Network Working Group M. Blanchet 3 Internet-Draft Viagenie 4 Intended status: Informational June 4, 2019 5 Expires: December 6, 2019 7 RDAP Deployment Findings and Update 8 draft-blanchet-regext-rdap-deployfindings-02 10 Abstract 12 Registration Access Data Protocol(RDAP) is being deployed in domain 13 and IP address registries. This document describes issues and 14 findings while interfacing with the known server implementations and 15 deployments. It also provides recommendations for the 16 specifications. 18 Status of This Memo 20 This Internet-Draft is submitted in full conformance with the 21 provisions of BCP 78 and BCP 79. 23 Internet-Drafts are working documents of the Internet Engineering 24 Task Force (IETF). Note that other groups may also distribute 25 working documents as Internet-Drafts. The list of current Internet- 26 Drafts is at https://datatracker.ietf.org/drafts/current/. 28 Internet-Drafts are draft documents valid for a maximum of six months 29 and may be updated, replaced, or obsoleted by other documents at any 30 time. It is inappropriate to use Internet-Drafts as reference 31 material or to cite them other than as "work in progress." 33 This Internet-Draft will expire on December 6, 2019. 35 Copyright Notice 37 Copyright (c) 2019 IETF Trust and the persons identified as the 38 document authors. All rights reserved. 40 This document is subject to BCP 78 and the IETF Trust's Legal 41 Provisions Relating to IETF Documents 42 (https://trustee.ietf.org/license-info) in effect on the date of 43 publication of this document. Please review these documents 44 carefully, as they describe your rights and restrictions with respect 45 to this document. Code Components extracted from this document must 46 include Simplified BSD License text as described in Section 4.e of 47 the Trust Legal Provisions and are provided without warranty as 48 described in the Simplified BSD License. 50 Table of Contents 52 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 53 2. IANA RDAP Registries Related Issues . . . . . . . . . . . . . 2 54 2.1. Values not Registered or Similar . . . . . . . . . . . . 3 55 2.2. RDAP Extensions not Registered . . . . . . . . . . . . . 4 56 3. RDAP Responses . . . . . . . . . . . . . . . . . . . . . . . 5 57 3.1. Cross-origin resource sharing(CORS) . . . . . . . . . . . 5 58 3.2. Object Class Name empty . . . . . . . . . . . . . . . . . 5 59 3.3. Links Relation Values . . . . . . . . . . . . . . . . . . 5 60 3.4. Related link pointing to self causes infinite loop . . . 6 61 3.5. Registrant Entity Too Deep . . . . . . . . . . . . . . . 7 62 4. Queries . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 63 4.1. URL encoding of : . . . . . . . . . . . . . . . . . . . . 8 64 5. Domain Registrar RDAP Server Location . . . . . . . . . . . . 8 65 6. Issues related to RFC7482 . . . . . . . . . . . . . . . . . . 8 66 6.1. Search patterns that are not . . . . . . . . . . . . . . 8 67 7. IANA RDAP Bootstrap Registries Related Issues . . . . . . . . 9 68 7.1. Missing Trailing Char in Bootstrap Registries . . . . . . 9 69 7.2. Single target value . . . . . . . . . . . . . . . . . . . 9 70 8. Security Considerations . . . . . . . . . . . . . . . . . . . 9 71 9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 9 72 10. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 9 73 11. References . . . . . . . . . . . . . . . . . . . . . . . . . 9 74 11.1. Normative References . . . . . . . . . . . . . . . . . . 9 75 11.2. Informative References . . . . . . . . . . . . . . . . . 10 76 11.3. URIs . . . . . . . . . . . . . . . . . . . . . . . . . . 10 77 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 10 79 1. Introduction 81 While developing various tools and software related to RDAP, issues 82 have been found and are documented below. This document should help 83 in writing future version of the specifications and provide better 84 conformant deployment. It is split in various sections based on 85 where the fix should be applied. Obviously, there are different 86 levels of severity of the issues, including nits or very minor. The 87 actual instances and organisations running the RDAP servers where the 88 issues were found are not listed. 90 2. IANA RDAP Registries Related Issues 92 This section describes issues related to the IANA non-Bootstrap 93 registries as specified in [RFC7483]. 95 2.1. Values not Registered or Similar 97 The IANA RDAP JSON Values registry [1] contains various values 98 expected in JSON responses. The following table shows values not 99 registered in the registry but seen in the field. The second column 100 shows the possible corresponding values already registered. 102 Recommendation: implementations should replace their custom values 103 with the registered ones, when one exist. Implementors should 104 register their values when there is no corresponding registered one. 106 Remarks Type 108 +---------------------------------+---------------------------------+ 109 | Unregistered Values | Possibly Corresponding | 110 | | Registered Values | 111 +---------------------------------+---------------------------------+ 112 | object truncated due to server | object truncated due to | 113 | policy | authorization | 114 | Response truncated due to | object truncated due to | 115 | authorization | authorization | 116 | Object truncated due to | object truncated due to | 117 | authorization | authorization | 118 | object redacted due to | object truncated due to | 119 | authorization | authorization | 120 +---------------------------------+---------------------------------+ 122 Event Action 124 +-----------------------------+-------------------------------------+ 125 | Unregistered Values | Possibly Corresponding Registered | 126 | | Values | 127 +-----------------------------+-------------------------------------+ 128 | delegation check | | 129 | last correct delegation | | 130 | check | | 131 | last update | last changed | 132 +-----------------------------+-------------------------------------+ 133 Status Value 135 +--------------------------+----------------------------------------+ 136 | Unregistered Values | Possibly Corresponding Registered | 137 | | Values | 138 +--------------------------+----------------------------------------+ 139 | server deleted | server delete prohibited | 140 | prohibited | | 141 | ok | active | 142 +--------------------------+----------------------------------------+ 144 Role Value 146 +---------------------+------------------------------------------+ 147 | Unregistered Values | Possibly Corresponding Registered Values | 148 +---------------------+------------------------------------------+ 149 | owner | registrant | 150 +---------------------+------------------------------------------+ 152 2.2. RDAP Extensions not Registered 154 The IANA RDAP Extensions registry [2] contains various extensions 155 values expected in RDAP JSON responses in the rdapCconformance 156 member. The following table shows values not registered in the 157 registry but seen in the field. The second column shows the possible 158 corresponding values already registered. 160 Recommendation: implementations should replace their custom values 161 with the registered ones, when one exist. Implementors should 162 register their values when there is no corresponding registered one. 164 +---------------------------------------------+---------------------+ 165 | Unregistered Values | Possibly | 166 | | Corresponding | 167 | | Registered Values | 168 +---------------------------------------------+---------------------+ 169 | rdap_objectTag_level_0 | rdap_objectTag | 170 | rdap_openidc_level_0 | | 171 | icann_rdap_technical_implementation_guide_0 | | 172 | icann_rdap_response_profile_0 | | 173 | itNic_level_0 | | 174 | fred_version_0 | fred | 175 | nicbr_level_0 | | 176 | ur_domain_check_level_0 | | 177 | history_version_0 | | 178 | registrar_api_0 | | 179 +---------------------------------------------+---------------------+ 181 3. RDAP Responses 183 This section discusses issues found related to RDAP responses, 184 specified in [RFC7483]. 186 3.1. Cross-origin resource sharing(CORS) 188 As specified in [RFC7480], the HTTP "Access-Control-Allow-Origin: *" 189 header should be included in the responses, to enable Web clients to 190 work properly. Some RDAP servers do not set this header. RFC7480 191 says "it is RECOMMENDED that servers". It should be updated to "for 192 any public Internet deployment, servers MUST". 194 3.2. Object Class Name empty 196 A non-conformant server sends the following answer, where the value 197 of "objectClassName" is an empty string (as well as "handle" also 198 empty). As per [RFC7483] section 4.9, this "objectClassName" value 199 is required. Extract of the seen response: 201 { 202 entities: [ 203 { 204 "entities": [ 205 { 206 "objectClassName": "", 207 "handle": "", 208 } 209 ], 210 ], 211 } 213 3.3. Links Relation Values 215 The links relation values as specified in [RFC7483] section 4.3 refer 216 to [RFC5988] which creates the IANA Link Relations registry [3]. 217 This registry contains a large number of values where most of them do 218 not apply to the RDAP deployment. As seen with other values above 219 that are similar to registered ones but not used, we list here the 220 ones we have seen. It would be appropriate to further describes the 221 main ones in the RFC so implementors focus on ones that are expected 222 instead of picking the wrong ones in the IANA registry or to define 223 new ones and do not register them. 225 Links Relation Values Seen 227 +---------------------------+-----------------------------+ 228 | Values | Registered in IANA registry | 229 +---------------------------+-----------------------------+ 230 | about | Y | 231 | alternate | Y | 232 | copyright | Y | 233 | describedBy | Y | 234 | help | Y | 235 | related | Y | 236 | self | Y | 237 | terms-of-service | Y | 238 | up | Y | 239 | https://restOfURLRedacted | N | 240 +---------------------------+-----------------------------+ 242 As shown in the table, an implementation put an URL as the value of 243 the "rel", instead of an actual registered value. 245 3.4. Related link pointing to self causes infinite loop 247 An RDAP server returns a link of "rel": "related" is pointing to 248 itself, therefore causing the RDAP client to fetch the object again, 249 then read the related link and then fetch again, creating an infinite 250 loop. Extract of the seen response: 252 { 253 "links": [ 254 { 255 "title": "Self", 256 "rel": "self", 257 "type": "application/rdap+json", 258 "href": "https://rdapserver.example.com/domain/example.net" 259 }, 260 { 261 "title": "Registrar Data for this object", 262 "rel": "related", 263 "href": "https://rdapserver.example.com/domain/example.net", 264 "type": "application/rdap+json" 265 } 266 ], 267 } 269 Recommendation: do not put related link same as self. RFC7483 270 section 4.2 should be updated to add the following text: "A link of 271 "rel": "related" should not have the "href" value the same as the 272 value of "href" of link of "rel": "self". 274 3.5. Registrant Entity Too Deep 276 An RDAP server returns the registrant entity in a subentity, which 277 makes difficult to parse given the expectation is the registrant 278 would be at the top level. Extract of the seen response: 280 { 281 entities: [ 282 { 283 "objectClassName": "entity", 284 "handle": "HANDLE1", 285 "roles": [ "abuse" ], 286 "vcardArray": [ ... ], 287 "entities": [ 288 { 289 "objectClassName": "entity", 290 "handle": "HANDLE2", 291 "roles": [ "registrant" ], 292 "vcardArray": [ ... ], 293 } 294 ], 295 ], 297 Recommendation: put the registrant in the top-level entities as 298 follows: 300 { 301 entities: [ 302 { 303 "objectClassName": "entity", 304 "handle": "HANDLE1", 305 "roles": [ "abuse" ], 306 "vcardArray": [ ... ] 307 }, 308 { 309 "objectClassName": "entity", 310 "handle": "HANDLE2", 311 "roles": [ "registrant" ], 312 "vcardArray": [ ... ], 313 } 314 ], 316 4. Queries 318 This section talks about support of RFC7482 queries and the RDAP 319 server behaviors seen. 321 4.1. URL encoding of : 323 For RIR registries, the ip query may include an IPv6 address which 324 then includes one or many ":". Clients may decide to do percent- 325 encoding of the query. In one RDAP server, the server rejected the 326 percent-encoded query of an IPv6 address. For example, 327 https://rdapserver.example.com/ip/2001%3Adb8%3A0%3A%3A/48 is 328 rejected, while https://rdapserver.example.com/ip/2001:db8:0::/48 is 329 accepted. 331 Recommendation: accept both percent-encoded queries or non-percent 332 encoded queries. 334 5. Domain Registrar RDAP Server Location 336 The ICANN RDAP Profile [4] section 3.2 requires the domain registries 337 who do not have registrant information (so-called thin registries) to 338 put a specific link of "rel": "related" pointing to the domain 339 registrar responsible for the domain being queried, so that a client 340 can get the registrant information using a second query to the 341 related link. However, the semantics seems ambiguous as other RDAP 342 servers may use the "rel": "related" for other related means, but not 343 the specific semantic of finding the registrant data. Therefore, a 344 possible mitigation is to define a new "rel" type of "registrantInfo" 345 (mnemonic TBD) to carry the specific semantic of registrant info. 347 6. Issues related to RFC7482 349 6.1. Search patterns that are not 351 Section 3.2.1 of [RFC7482] says: "domains?nsIp=ZZZZ. ZZZZ is a 352 search pattern representing an IPv4 [RFC1166] or IPv6 [RFC5952] 353 address.". Search pattern has been used throughout the document as 354 something that can include '*', while here, it does not. The syntax 355 statement is also misleading. Similarly, section 3.2.2 says: 356 "nameservers?ip=YYYY YYYY is a search pattern representing an IPv4 357 [RFC1166] or IPv6 [RFC5952] address." 359 Recommendation: in [RFC7482], replace: "ZZZZ is a search pattern 360 representing an IPv4" by "ZZZZ is an IPv4", "Syntax: 361 domains?nsIp=" by "Syntax: 362 domains?nsIp=", "YYYY is a search pattern 363 representing an IPv4" by "YYYY is an IPv4", "Syntax: 364 nameservers?ip=" by "Syntax: 365 nameservers?ip=" 367 7. IANA RDAP Bootstrap Registries Related Issues 369 This section describes issues related to the IANA Bootstrap 370 registries as specified in [RFC7484]. 372 7.1. Missing Trailing Char in Bootstrap Registries 374 [RFC7484] section 3 says: "Base RDAP URLs MUST have a trailing "/" 375 character". However, some values in the various IANA Bootstrap 376 registries do not have the trailing "/" character. These should be 377 added to provide consistency. 379 7.2. Single target value 381 [RFC7484] provides a way to list multiple RDAP servers for an entry. 382 This flexibility was designed initially to support multiple URI 383 types, such as http: and https, and to provide some level of 384 redundancy. However, given that security deployment policy is to use 385 https everywhere and redundancy can be accomplished in other ways, 386 deployment has shown that all entries in all bootstrap registries 387 have a single target RDAP URL value. Therefore, we can consider 388 updating the RFC to provide only one target value. However, this 389 should be done carefully to avoid breaking current deployed clients. 391 8. Security Considerations 393 Proper conformance to specifications helps security. However, no 394 security issues have been found in the context of this draft. 396 9. IANA Considerations 398 This document request IANA to add the following values to this 399 registry. TBD. 401 10. Acknowledgements 403 Audric Schiltknecht, TBD have provided input and suggestions to this 404 document. 406 11. References 408 11.1. Normative References 410 [RFC7480] Newton, A., Ellacott, B., and N. Kong, "HTTP Usage in the 411 Registration Data Access Protocol (RDAP)", RFC 7480, 412 DOI 10.17487/RFC7480, March 2015, 413 . 415 [RFC7482] Newton, A. and S. Hollenbeck, "Registration Data Access 416 Protocol (RDAP) Query Format", RFC 7482, 417 DOI 10.17487/RFC7482, March 2015, 418 . 420 [RFC7483] Newton, A. and S. Hollenbeck, "JSON Responses for the 421 Registration Data Access Protocol (RDAP)", RFC 7483, 422 DOI 10.17487/RFC7483, March 2015, 423 . 425 [RFC7484] Blanchet, M., "Finding the Authoritative Registration Data 426 (RDAP) Service", RFC 7484, DOI 10.17487/RFC7484, March 427 2015, . 429 11.2. Informative References 431 [RFC5988] Nottingham, M., "Web Linking", RFC 5988, 432 DOI 10.17487/RFC5988, October 2010, 433 . 435 11.3. URIs 437 [1] https://www.iana.org/assignments/rdap-json-values/rdap-json- 438 values.xhtml 440 [2] https://www.iana.org/assignments/rdap-extensions/rdap- 441 extensions.xhtml 443 [3] https://www.iana.org/assignments/link-relations/link- 444 relations.xhtml 446 [4] https://www.icann.org/en/system/files/files/rdap-technical- 447 implementation-guide-15feb19-en.pdf 449 Author's Address 451 Marc Blanchet 452 Viagenie 453 246 Aberdeen 454 Quebec, QC G1R 2E1 455 Canada 457 Email: marc.blanchet@viagenie.ca 458 URI: http://viagenie.ca