idnits 2.17.1 draft-blanchet-regext-rdap-deployfindings-03.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- ** The document seems to lack a both a reference to RFC 2119 and the recommended RFC 2119 boilerplate, even if it appears to use RFC 2119 keywords. RFC 2119 keyword, line 234: '... says "it is RECOMMENDED that server...' RFC 2119 keyword, line 417: '... [RFC7484] section 3 says: "Base RDAP URLs MUST have a trailing "/"...' Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (June 5, 2019) is 1788 days in the past. Is this intentional? Checking references for intended status: Informational ---------------------------------------------------------------------------- -- Looks like a reference, but probably isn't: '1' on line 484 -- Looks like a reference, but probably isn't: '2' on line 487 -- Looks like a reference, but probably isn't: '3' on line 490 -- Looks like a reference, but probably isn't: '4' on line 493 == Missing Reference: 'RFC1166' is mentioned on line 400, but not defined == Missing Reference: 'RFC5952' is mentioned on line 400, but not defined ** Obsolete normative reference: RFC 7482 (Obsoleted by RFC 9082) ** Obsolete normative reference: RFC 7483 (Obsoleted by RFC 9083) ** Obsolete normative reference: RFC 7484 (Obsoleted by RFC 9224) -- Obsolete informational reference (is this intentional?): RFC 5988 (Obsoleted by RFC 8288) Summary: 4 errors (**), 0 flaws (~~), 3 warnings (==), 6 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 Network Working Group M. Blanchet 3 Internet-Draft Viagenie 4 Intended status: Informational June 5, 2019 5 Expires: December 7, 2019 7 RDAP Deployment Findings and Update 8 draft-blanchet-regext-rdap-deployfindings-03 10 Abstract 12 Registration Access Data Protocol(RDAP) is being deployed in domain 13 and IP address registries. This document describes issues and 14 findings while interfacing with the known server implementations and 15 deployments. It also provides recommendations for the 16 specifications. 18 Status of This Memo 20 This Internet-Draft is submitted in full conformance with the 21 provisions of BCP 78 and BCP 79. 23 Internet-Drafts are working documents of the Internet Engineering 24 Task Force (IETF). Note that other groups may also distribute 25 working documents as Internet-Drafts. The list of current Internet- 26 Drafts is at https://datatracker.ietf.org/drafts/current/. 28 Internet-Drafts are draft documents valid for a maximum of six months 29 and may be updated, replaced, or obsoleted by other documents at any 30 time. It is inappropriate to use Internet-Drafts as reference 31 material or to cite them other than as "work in progress." 33 This Internet-Draft will expire on December 7, 2019. 35 Copyright Notice 37 Copyright (c) 2019 IETF Trust and the persons identified as the 38 document authors. All rights reserved. 40 This document is subject to BCP 78 and the IETF Trust's Legal 41 Provisions Relating to IETF Documents 42 (https://trustee.ietf.org/license-info) in effect on the date of 43 publication of this document. Please review these documents 44 carefully, as they describe your rights and restrictions with respect 45 to this document. Code Components extracted from this document must 46 include Simplified BSD License text as described in Section 4.e of 47 the Trust Legal Provisions and are provided without warranty as 48 described in the Simplified BSD License. 50 Table of Contents 52 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 53 2. IANA RDAP Registries Related Issues . . . . . . . . . . . . . 2 54 2.1. Values not Registered or Similar . . . . . . . . . . . . 3 55 2.1.1. Registry Entity . . . . . . . . . . . . . . . . . . . 4 56 2.2. RDAP Extensions not Registered . . . . . . . . . . . . . 4 57 3. RDAP Responses . . . . . . . . . . . . . . . . . . . . . . . 5 58 3.1. Cross-origin resource sharing(CORS) . . . . . . . . . . . 6 59 3.2. Object Class Name empty . . . . . . . . . . . . . . . . . 6 60 3.3. Links Relation Values . . . . . . . . . . . . . . . . . . 6 61 3.4. Related link pointing to self causes infinite loop . . . 7 62 3.5. Registrant Entity Too Deep . . . . . . . . . . . . . . . 8 63 4. Queries . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 64 4.1. URL encoding of : . . . . . . . . . . . . . . . . . . . . 9 65 5. Domain Registrar RDAP Server Location . . . . . . . . . . . . 9 66 6. Issues related to RFC7482 . . . . . . . . . . . . . . . . . . 9 67 6.1. Search patterns that are not . . . . . . . . . . . . . . 9 68 7. IANA RDAP Bootstrap Registries Related Issues . . . . . . . . 10 69 7.1. Missing Trailing Char in Bootstrap Registries . . . . . . 10 70 7.2. Single target value . . . . . . . . . . . . . . . . . . . 10 71 8. Security Considerations . . . . . . . . . . . . . . . . . . . 10 72 9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 10 73 10. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 10 74 11. References . . . . . . . . . . . . . . . . . . . . . . . . . 10 75 11.1. Normative References . . . . . . . . . . . . . . . . . . 10 76 11.2. Informative References . . . . . . . . . . . . . . . . . 11 77 11.3. URIs . . . . . . . . . . . . . . . . . . . . . . . . . . 11 78 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 11 80 1. Introduction 82 While developing various tools and software related to RDAP, issues 83 have been found and are documented below. This document should help 84 in writing future version of the specifications and provide better 85 conformant deployment. It is split in various sections based on 86 where the fix should be applied. Obviously, there are different 87 levels of severity of the issues, including nits or very minor. The 88 actual instances and organisations running the RDAP servers where the 89 issues were found are not listed. 91 2. IANA RDAP Registries Related Issues 93 This section describes issues related to the IANA non-Bootstrap 94 registries as specified in [RFC7483]. 96 2.1. Values not Registered or Similar 98 The IANA RDAP JSON Values registry [1] contains various values 99 expected in JSON responses. The following table shows values not 100 registered in the registry but seen in the field. The second column 101 shows the possible corresponding values already registered. 103 Recommendation: implementations should replace their custom values 104 with the registered ones, when one exist. Implementors should 105 register their values when there is no corresponding registered one. 107 Remarks Type 109 +---------------------------------+---------------------------------+ 110 | Unregistered Values | Possibly Corresponding | 111 | | Registered Values | 112 +---------------------------------+---------------------------------+ 113 | object truncated due to server | object truncated due to | 114 | policy | authorization | 115 | Response truncated due to | object truncated due to | 116 | authorization | authorization | 117 | Object truncated due to | object truncated due to | 118 | authorization | authorization | 119 | object redacted due to | object truncated due to | 120 | authorization | authorization | 121 +---------------------------------+---------------------------------+ 123 Event Action 125 +-----------------------------+-------------------------------------+ 126 | Unregistered Values | Possibly Corresponding Registered | 127 | | Values | 128 +-----------------------------+-------------------------------------+ 129 | delegation check | | 130 | last correct delegation | | 131 | check | | 132 | last update | last changed | 133 +-----------------------------+-------------------------------------+ 134 Status Value 136 +--------------------------+----------------------------------------+ 137 | Unregistered Values | Possibly Corresponding Registered | 138 | | Values | 139 +--------------------------+----------------------------------------+ 140 | server deleted | server delete prohibited | 141 | prohibited | | 142 | ok | active | 143 +--------------------------+----------------------------------------+ 145 Role Value 147 +---------------------+------------------------------------------+ 148 | Unregistered Values | Possibly Corresponding Registered Values | 149 +---------------------+------------------------------------------+ 150 | owner | registrant | 151 +---------------------+------------------------------------------+ 153 2.1.1. Registry Entity 155 The (domain or IP) registry itself is currently not modeled in 156 entities in RDAP. In an whois query for a TLD itself, the Remarks 157 contains the URL of the registry entity (for registration 158 information) and the whois entry of the registry is returned. In 159 RDAP context, the RDAP server URL of the TLD registry should also be 160 returned. Therefore, IANA RDAP server should send this data for the 161 TLDs as part of its RDAP response. These semantics are currently not 162 modeled. 164 This document proposes that RDAP servers may send an entity with role 165 "registry" in the top-level of the RDAP response. This entity would 166 have embedded [links] to its web server ("rel": "self", "type": 167 "text/html") and rdap server ("rel": "self", "type": "application/ 168 rdap+json"). 170 IANA Action: add a new row "registry", "role" to the RDAP JSON Values 171 registry. 173 2.2. RDAP Extensions not Registered 175 The IANA RDAP Extensions registry [2] contains various extensions 176 values expected in RDAP JSON responses in the rdapCconformance 177 member. It is our understanding from [RFC7483] section 4.1 and 178 [RFC7480] section 8.1 that only the prefix of the extension (i.e. 179 "rdap_ObjectTag"), not the whole string ("rdap_objectTag_level_0"), 180 need to be registered in the IANA registry. However, some entries in 181 the IANA RDAP extensions registry seem to imply a 0 version as part 182 of the registered value. 184 The following table shows values seen in the field in the first 185 column, corresponding prefix (guessed as there is no clear delimiter) 186 in the second column and if the prefix is registered in IANA registry 187 in the third column. 189 This registry may end up listing all names of all registries if each 190 one has his own extension. Moreover, there is no clear delimiter of 191 the prefix in the full string, which may not help the RDAP client to 192 interpret correctly. As with [RFC6350], we may instead use the First 193 Come First Serve(FCFS) private enterprise numbers (PEN) registry to 194 automatically have an organisation prefix defined without creating 195 another set of org names within this registry and have the delimiter 196 be "_" following the PEN. 198 Recommendation (short term): implementations should replace their 199 custom values with the registered ones, when one exist. Implementors 200 should register their values when there is no corresponding 201 registered one. 203 +----------------------------+----------------------------+---------+ 204 | Values Seen | Corresponding Assumed | Prefix | 205 | | Prefix | Already | 206 | | | Registe | 207 | | | red in | 208 | | | IANA | 209 +----------------------------+----------------------------+---------+ 210 | rdap_objectTag_level_0 | rdap_objectTag | Y | 211 | fred_version_0 | fred | Y | 212 | rdap_openidc_level_0 | rdap_openidc | N | 213 | icann_rdap_technical_imple | icann_rdap_technical_imple | N | 214 | mentation_guide_0 | mentation_guide | | 215 | icann_rdap_response_profil | icann_rdap_response_profil | N | 216 | e_0 | e | | 217 | itNic_level_0 | itNic | N | 218 | nicbr_level_0 | nicbr | N | 219 | ur_domain_check_level_0 | | N | 220 | history_version_0 | | N | 221 | registrar_api_0 | | N | 222 +----------------------------+----------------------------+---------+ 224 3. RDAP Responses 226 This section discusses issues found related to RDAP responses, 227 specified in [RFC7483]. 229 3.1. Cross-origin resource sharing(CORS) 231 As specified in [RFC7480], the HTTP "Access-Control-Allow-Origin: *" 232 header should be included in the responses, to enable Web clients to 233 work properly. Some RDAP servers do not set this header. RFC7480 234 says "it is RECOMMENDED that servers". It should be updated to "for 235 any public Internet deployment, servers MUST". 237 3.2. Object Class Name empty 239 A non-conformant server sends the following answer, where the value 240 of "objectClassName" is an empty string (as well as "handle" also 241 empty). As per [RFC7483] section 4.9, this "objectClassName" value 242 is required. Extract of the seen response: 244 { 245 entities: [ 246 { 247 "entities": [ 248 { 249 "objectClassName": "", 250 "handle": "", 251 } 252 ], 253 ], 254 } 256 3.3. Links Relation Values 258 The links relation values as specified in [RFC7483] section 4.3 refer 259 to [RFC5988] which creates the IANA Link Relations registry [3]. 260 This registry contains a large number of values where most of them do 261 not apply to the RDAP deployment. As seen with other values above 262 that are similar to registered ones but not used, we list here the 263 ones we have seen. It would be appropriate to further describes the 264 main ones in the RFC so implementors focus on ones that are expected 265 instead of picking the wrong ones in the IANA registry or to define 266 new ones and do not register them. 268 Links Relation Values Seen 270 +---------------------------+-----------------------------+ 271 | Values | Registered in IANA registry | 272 +---------------------------+-----------------------------+ 273 | about | Y | 274 | alternate | Y | 275 | copyright | Y | 276 | describedBy | Y | 277 | help | Y | 278 | related | Y | 279 | self | Y | 280 | terms-of-service | Y | 281 | up | Y | 282 | https://restOfURLRedacted | N | 283 +---------------------------+-----------------------------+ 285 As shown in the table, an implementation put an URL as the value of 286 the "rel", instead of an actual registered value. 288 3.4. Related link pointing to self causes infinite loop 290 An RDAP server returns a link of "rel": "related" is pointing to 291 itself, therefore causing the RDAP client to fetch the object again, 292 then read the related link and then fetch again, creating an infinite 293 loop. Extract of the seen response: 295 { 296 "links": [ 297 { 298 "title": "Self", 299 "rel": "self", 300 "type": "application/rdap+json", 301 "href": "https://rdapserver.example.com/domain/example.net" 302 }, 303 { 304 "title": "Registrar Data for this object", 305 "rel": "related", 306 "href": "https://rdapserver.example.com/domain/example.net", 307 "type": "application/rdap+json" 308 } 309 ], 310 } 312 Recommendation: do not put related link same as self. RFC7483 313 section 4.2 should be updated to add the following text: "A link of 314 "rel": "related" should not have the "href" value the same as the 315 value of "href" of link of "rel": "self". 317 3.5. Registrant Entity Too Deep 319 An RDAP server returns the registrant entity in a subentity, which 320 makes difficult to parse given the expectation is the registrant 321 would be at the top level. Extract of the seen response: 323 { 324 entities: [ 325 { 326 "objectClassName": "entity", 327 "handle": "HANDLE1", 328 "roles": [ "abuse" ], 329 "vcardArray": [ ... ], 330 "entities": [ 331 { 332 "objectClassName": "entity", 333 "handle": "HANDLE2", 334 "roles": [ "registrant" ], 335 "vcardArray": [ ... ], 336 } 337 ], 338 ], 340 Recommendation: put the registrant in the top-level entities as 341 follows: 343 { 344 entities: [ 345 { 346 "objectClassName": "entity", 347 "handle": "HANDLE1", 348 "roles": [ "abuse" ], 349 "vcardArray": [ ... ] 350 }, 351 { 352 "objectClassName": "entity", 353 "handle": "HANDLE2", 354 "roles": [ "registrant" ], 355 "vcardArray": [ ... ], 356 } 357 ], 359 4. Queries 361 This section talks about support of RFC7482 queries and the RDAP 362 server behaviors seen. 364 4.1. URL encoding of : 366 For RIR registries, the ip query may include an IPv6 address which 367 then includes one or many ":". Clients may decide to do percent- 368 encoding of the query. In one RDAP server, the server rejected the 369 percent-encoded query of an IPv6 address. For example, 370 https://rdapserver.example.com/ip/2001%3Adb8%3A0%3A%3A/48 is 371 rejected, while https://rdapserver.example.com/ip/2001:db8:0::/48 is 372 accepted. 374 Recommendation: accept both percent-encoded queries or non-percent 375 encoded queries. 377 5. Domain Registrar RDAP Server Location 379 The ICANN RDAP Profile [4] section 3.2 requires the domain registries 380 who do not have registrant information (so-called thin registries) to 381 put a specific link of "rel": "related" pointing to the domain 382 registrar responsible for the domain being queried, so that a client 383 can get the registrant information using a second query to the 384 related link. However, the semantics seems ambiguous as other RDAP 385 servers may use the "rel": "related" for other related means, but not 386 the specific semantic of finding the registrant data. Therefore, a 387 possible mitigation is to define a new "rel" type of "registrantInfo" 388 (mnemonic TBD) to carry the specific semantic of registrant info. 390 6. Issues related to RFC7482 392 6.1. Search patterns that are not 394 Section 3.2.1 of [RFC7482] says: "domains?nsIp=ZZZZ. ZZZZ is a 395 search pattern representing an IPv4 [RFC1166] or IPv6 [RFC5952] 396 address.". Search pattern has been used throughout the document as 397 something that can include '*', while here, it does not. The syntax 398 statement is also misleading. Similarly, section 3.2.2 says: 399 "nameservers?ip=YYYY YYYY is a search pattern representing an IPv4 400 [RFC1166] or IPv6 [RFC5952] address." 402 Recommendation: in [RFC7482], replace: "ZZZZ is a search pattern 403 representing an IPv4" by "ZZZZ is an IPv4", "Syntax: 404 domains?nsIp=" by "Syntax: 405 domains?nsIp=", "YYYY is a search pattern 406 representing an IPv4" by "YYYY is an IPv4", "Syntax: 407 nameservers?ip=" by "Syntax: 408 nameservers?ip=" 410 7. IANA RDAP Bootstrap Registries Related Issues 412 This section describes issues related to the IANA Bootstrap 413 registries as specified in [RFC7484]. 415 7.1. Missing Trailing Char in Bootstrap Registries 417 [RFC7484] section 3 says: "Base RDAP URLs MUST have a trailing "/" 418 character". However, some values in the various IANA Bootstrap 419 registries do not have the trailing "/" character. These should be 420 added to provide consistency. 422 7.2. Single target value 424 [RFC7484] provides a way to list multiple RDAP servers for an entry. 425 This flexibility was designed initially to support multiple URI 426 types, such as http: and https, and to provide some level of 427 redundancy. However, given that security deployment policy is to use 428 https everywhere and redundancy can be accomplished in other ways, 429 deployment has shown that all entries in all bootstrap registries 430 have a single target RDAP URL value. Therefore, we can consider 431 updating the RFC to provide only one target value. However, this 432 should be done carefully to avoid breaking current deployed clients. 434 8. Security Considerations 436 Proper conformance to specifications helps security. However, no 437 security issues have been found in the context of this draft. 439 9. IANA Considerations 441 This document request IANA to add the following values to this 442 registry. TBD. See 'IANA Action:' within the document. 444 10. Acknowledgements 446 Audric Schiltknecht, Mario Loffredo, Justin Mack have provided input 447 and suggestions to this document. 449 11. References 451 11.1. Normative References 453 [RFC7480] Newton, A., Ellacott, B., and N. Kong, "HTTP Usage in the 454 Registration Data Access Protocol (RDAP)", RFC 7480, 455 DOI 10.17487/RFC7480, March 2015, 456 . 458 [RFC7482] Newton, A. and S. Hollenbeck, "Registration Data Access 459 Protocol (RDAP) Query Format", RFC 7482, 460 DOI 10.17487/RFC7482, March 2015, 461 . 463 [RFC7483] Newton, A. and S. Hollenbeck, "JSON Responses for the 464 Registration Data Access Protocol (RDAP)", RFC 7483, 465 DOI 10.17487/RFC7483, March 2015, 466 . 468 [RFC7484] Blanchet, M., "Finding the Authoritative Registration Data 469 (RDAP) Service", RFC 7484, DOI 10.17487/RFC7484, March 470 2015, . 472 11.2. Informative References 474 [RFC5988] Nottingham, M., "Web Linking", RFC 5988, 475 DOI 10.17487/RFC5988, October 2010, 476 . 478 [RFC6350] Perreault, S., "vCard Format Specification", RFC 6350, 479 DOI 10.17487/RFC6350, August 2011, 480 . 482 11.3. URIs 484 [1] https://www.iana.org/assignments/rdap-json-values/rdap-json- 485 values.xhtml 487 [2] https://www.iana.org/assignments/rdap-extensions/rdap- 488 extensions.xhtml 490 [3] https://www.iana.org/assignments/link-relations/link- 491 relations.xhtml 493 [4] https://www.icann.org/en/system/files/files/rdap-technical- 494 implementation-guide-15feb19-en.pdf 496 Author's Address 498 Marc Blanchet 499 Viagenie 500 246 Aberdeen 501 Quebec, QC G1R 2E1 502 Canada 504 Email: marc.blanchet@viagenie.ca 505 URI: http://viagenie.ca