Internet Engineering Task Force T. Harrison Internet-Draft APNIC Intended status: Standards Track J. Singh Expires: 3 November 2023 ARIN 2 May 2023 RDAP RIR Search draft-ietf-regext-rdap-rir-search-02 Abstract The Registration Data Access Protocol (RDAP) is used by Regional Internet Registries (RIRs) and Domain Name Registries (DNRs) to provide access to their resource registration information. The core specifications for RDAP define basic search functionality, but there are various IP and ASN-related search options provided by RIRs via their Whois services for which there is no corresponding RDAP functionality. This document extends RDAP to support those search options. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on 3 November 2023. Copyright Notice Copyright (c) 2023 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/ license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components Harrison & Singh Expires 3 November 2023 [Page 1] Internet-Draft RDAP RIR Search May 2023 extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 1.1. Requirements Language . . . . . . . . . . . . . . . . . . 3 2. Basic Searches . . . . . . . . . . . . . . . . . . . . . . . 3 2.1. Path Segments . . . . . . . . . . . . . . . . . . . . . . 3 2.2. IP Network Search . . . . . . . . . . . . . . . . . . . . 3 2.3. Autonomous System Number Search . . . . . . . . . . . . . 4 3. Relation Searches . . . . . . . . . . . . . . . . . . . . . . 5 3.1. Path Segments . . . . . . . . . . . . . . . . . . . . . . 5 3.2. Relation Search . . . . . . . . . . . . . . . . . . . . . 5 3.2.1. Definitions . . . . . . . . . . . . . . . . . . . . . 5 3.2.2. Relations . . . . . . . . . . . . . . . . . . . . . . 7 3.2.2.1. up . . . . . . . . . . . . . . . . . . . . . . . 7 3.2.2.2. down . . . . . . . . . . . . . . . . . . . . . . 8 3.2.2.3. top . . . . . . . . . . . . . . . . . . . . . . . 8 3.2.2.4. bottom . . . . . . . . . . . . . . . . . . . . . 8 3.3. Status . . . . . . . . . . . . . . . . . . . . . . . . . 8 3.4. Link Relations . . . . . . . . . . . . . . . . . . . . . 8 4. Responding To Searches . . . . . . . . . . . . . . . . . . . 10 5. Reverse Search . . . . . . . . . . . . . . . . . . . . . . . 11 6. RDAP Conformance . . . . . . . . . . . . . . . . . . . . . . 11 7. Privacy Considerations . . . . . . . . . . . . . . . . . . . 12 8. Security Considerations . . . . . . . . . . . . . . . . . . . 12 9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 12 10. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 16 11. References . . . . . . . . . . . . . . . . . . . . . . . . . 16 11.1. Normative References . . . . . . . . . . . . . . . . . . 16 11.2. Informative References . . . . . . . . . . . . . . . . . 17 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 17 1. Introduction The Registration Data Access Protocol (RDAP) [RFC7480] is used by Regional Internet Registries (RIRs) and Domain Name Registries (DNRs) to provide access to their resource registration information. The core specifications for RDAP define basic search functionality, but this is limited to domains, nameservers, and entities. No searches were defined for IP networks or autonomous system numbers. In an effort to have RDAP reach feature parity with the existing RIR Whois services in this respect, this document defines additional search options for IP networks and autonomous system numbers. Harrison & Singh Expires 3 November 2023 [Page 2] Internet-Draft RDAP RIR Search May 2023 While this document is in terms of RIRs and DNRs for the sake of consistency with earlier RDAP documents such as [RFC9082] and [RFC9083], the functionality described here may be used by any RDAP server operator that hosts Internet Number Resource (INR) objects, such as National Internet Registries (NIRs) or Local Internet Registries (LIRs). 1.1. Requirements Language The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] [RFC8174]. 2. Basic Searches 2.1. Path Segments The new resource type path segments for basic search (similar to the searches defined in [RFC9082] and [RFC9083] are: 'ips': Used to identify an IP network search using a pattern to match one of a set of IP network attributes. 'autnums': Used to identify an Autonomous System number search using a pattern to match one of a set of Autonomous System number attributes. Search path segments are formed using the same logic as in section 3.2 of [RFC9082]. 2.2. IP Network Search Syntax: ips?handle= Syntax: ips?name= Searches for IP network information by handle are specified using the form: ips?handle=XXXX XXXX is a search pattern representing an IP network identifier, the syntax for which is specific to the registration provider. The following URL would be used to find information for IP networks with handles matching the "NET-199*" pattern: https://example.com/rdap/ips?handle=NET-199* Harrison & Singh Expires 3 November 2023 [Page 3] Internet-Draft RDAP RIR Search May 2023 Searches for IP network information by name are specified using the form: ips?name=XXXX XXXX is a search pattern representing an IP network identifier that is assigned to the network registration by the registration holder. The following URL would be used to find information for IP networks with names matching the "NET-EXAMPLE-*" pattern: https://example.com/rdap/ips?name=NET-EXAMPLE-* 2.3. Autonomous System Number Search Syntax: autnums?handle= Syntax: autnums?name= Searches for autonomous system number information by handle are specified using the form: autnums?handle=XXXX XXXX is a search pattern representing an autonomous system number identifier, the syntax for which is specific to the registration provider. The following URL would be used to find information for autonomous system numbers with handles matching the "AS1*" pattern: https://example.com/rdap/autnums?handle=AS1* Searches for autonomous system number information by name are specified using the form: autnums?name=XXXX XXXX is a search pattern representing an autonomous system number identifier that is assigned to the autonomous system number registration by the registration holder. The following URL would be used to find information for autonomous system numbers with names matching the "ASN-EXAMPLE-*" pattern: https://example.com/rdap/autnums?name=ASN-EXAMPLE-* Harrison & Singh Expires 3 November 2023 [Page 4] Internet-Draft RDAP RIR Search May 2023 3. Relation Searches [RFC9083] contains example objects that make use of the "up" link relation in order to simplify the process of finding the parent object for a given object. This section defines searches for finding objects and sets of objects with respect to their place within a hierarchy. 3.1. Path Segments The new resource type path segments for relation search (similar to the searches defined in [RFC9082] and [RFC9083]) are: 'ips/rir_search//': Used to identify an IP network search using a relation and an address to match a set of IP networks. 'ips/rir_search///': Used to identify an IP network search using a relation and a range to match a set of IP networks. 'autnums/rir_search//': Used to identify an Autonomous System number search using a relation and a single ASN or an ASN range and to match a set of ASN objects. 'domains/rir_search//': Used to identify a reverse domain search using a relation and a reverse domain name to match a set of reverse domains. 3.2. Relation Search Syntax: /rir_search//[?status=] The relation searches defined in this document rely on the syntax described above. Each search works in the same way for each object type. 3.2.1. Definitions An IP network, autonomous system number, or reverse domain object may have a "parent" object and one or more "child" objects. The "parent" object is the next-least-specific object that exists in the relevant registry, while the "child" objects are the next-most-specific objects that exist in the relevant registry. For example, for a registry with the following four IP network objects: Harrison & Singh Expires 3 November 2023 [Page 5] Internet-Draft RDAP RIR Search May 2023 +--------------+ | 192.0.2.0/24 | +--------------+ / \ +--------------+ +----------------+ | 192.0.2.0/25 | | 192.0.128.0/25 | +--------------+ +----------------+ / +--------------+ | 192.0.2.0/32 | +--------------+ Figure 1: Example Registry Objects the parent and child object relationships are: +================+==============+ | Object | Parent | +================+==============+ | 192.0.2.0/32 | 192.0.2.0/25 | +----------------+--------------+ | 192.0.2.128/25 | 192.0.2.0/24 | +----------------+--------------+ | 192.0.2.0/25 | 192.0.2.0/24 | +----------------+--------------+ | 192.0.2.0/24 | N/A | +----------------+--------------+ Table 1: Parent objects +================+==============================+ | Object | Child | +================+==============================+ | 192.0.2.0/24 | 192.0.2.0/25, 192.0.2.128/25 | +----------------+------------------------------+ | 192.0.2.0/25 | 192.0.2.0/32 | +----------------+------------------------------+ | 192.0.2.128/25 | N/A | +----------------+------------------------------+ | 192.0.2.0/32 | N/A | +----------------+------------------------------+ Table 2: Child objects Along similar lines, each object of these types may have a "top" object, being the least-specific covering object that exists in the registry, and one or more "bottom" objects, being the more-specific objects which do not themselves have more-specific objects that Harrison & Singh Expires 3 November 2023 [Page 6] Internet-Draft RDAP RIR Search May 2023 entirely cover the object's range when taken together. Given the registry defined in the previous paragraph, the top and bottom object relationships are: +================+==============+ | Object | Top | +================+==============+ | 192.0.2.0/32 | 192.0.2.0/24 | +----------------+--------------+ | 192.0.2.128/25 | 192.0.2.0/24 | +----------------+--------------+ | 192.0.2.0/25 | 192.0.2.0/24 | +----------------+--------------+ | 192.0.2.0/24 | N/A | +----------------+--------------+ Table 3: Top objects +================+============================================+ | Object | Bottom | +================+============================================+ | 192.0.2.0/24 | 192.0.2.0/25, 192.0.2.0/32, 192.0.2.128/25 | +----------------+--------------------------------------------+ | 192.0.2.0/25 | 192.0.2.0/25, 192.0.2.0/32 | +----------------+--------------------------------------------+ | 192.0.2.128/25 | N/A | +----------------+--------------------------------------------+ | 192.0.2.0/32 | N/A | +----------------+--------------------------------------------+ Table 4: Bottom objects The set of objects at the bottom of the hierarchy for a given object will include the object itself where that object's more-specific objects do not entirely cover the object's range when taken together. This is why 192.0.2.0/25 is included as one of the bottom set of objects for itself. Conversely, 192.0.2.0/24 is not included as one of the bottom set of objects for itself, because it is covered in whole by 192.0.2.0/25 and 192.0.2.128/25. 3.2.2. Relations 3.2.2.1. up If the server receives a search containing the relation value "up", it will return the parent object for the specified INR value/range or reverse domain. If no such object exists, it will return an empty search response. Harrison & Singh Expires 3 November 2023 [Page 7] Internet-Draft RDAP RIR Search May 2023 3.2.2.2. down If the server receives a search containing the relation value "down", it will return the children objects for the specified INR value/range or reverse domain. If no such objects exist, it will return an empty search response. Per the definitions section, this includes only immediate children objects. 3.2.2.3. top If the server receives a search containing the relation value "top", it will return the top object for the specified INR value/range or reverse domain. If no such object exists, it will return an empty search response. 3.2.2.4. bottom If the server receives a search containing the relation value "bottom", it will return the bottom objects for the specified INR value/range or reverse domain. If no such objects exist, it will return an empty search response. 3.3. Status If the "status" argument is provided, then response processing will take into account only those objects that have the specified status. This is useful, for example, where the client is trying to find the delegation from an RIR to an RIR account holder: by using the "top" relation with a "status" of "active", the delegation from IANA to the RIR will be ignored, and the client will receive the delegation from the RIR to the account holder in the response instead. Server operators MAY opt not to support "status" processing for the "down" and "bottom" link relations, in which case the server should respond with a HTTP 501 (Not Implemented) [RFC9110] if they receive such a request. 3.4. Link Relations Each of the relations defined in section 3.2.2 has a corresponding link relation that can be used for a link object contained within another RDAP object. The response returned by a server when fetching the link target for a link within an RDAP object with one of those link relations MUST be the same response that would be returned for the corresponding search. For example: Harrison & Singh Expires 3 November 2023 [Page 8] Internet-Draft RDAP RIR Search May 2023 { "startAddress": "192.0.2.0", "endAddress": "192.0.2.127", ... "links": [ ..., { "value": "https://rdap.example.com/ip/192.0.2.0/25", "rel": "up", "href": ".../ips/rir_search/up/192.0.2.0/25", "type": "application/rdap+json" }, { "value": "https://rdap.example.com/ip/192.0.2.0/25", "rel": "down", "href": ".../ips/rir_search/down/192.0.2.0/25", "type": "application/rdap+json" }, { "value": "https://rdap.example.com/ip/192.0.2.0/25", "rel": "top", "href": ".../ips/rir_search/top/192.0.2.0/25", "type": "application/rdap+json" }, { "value": "https://rdap.example.com/ip/192.0.2.0/25", "rel": "bottom", "href": ".../ips/rir_search/bottom/192.0.2.0/25", "type": "application/rdap+json" } ] } Figure 2: Example links Two additional link relations are defined that correspond to relation searches with a "status" of "active": "top-active" and "up-active". The equivalent link relations for "down" and "bottom" are not defined, because it is not expected that they will be used. Since the "top" and "up" link relations resolve to a single object, it is possible to simply include that object's link in the "href" attribute in the link object. For example: Harrison & Singh Expires 3 November 2023 [Page 9] Internet-Draft RDAP RIR Search May 2023 { "startAddress": "192.0.2.0", "endAddress": "192.0.2.127", ... "links": [ ..., { "value": "https://rdap.example.com/ip/192.0.2.0/25", "rel": "up", "href": "https://rdap.example.com/192.0.2.0/24", "type": "application/rdap+json" } ] } Figure 3: Example single object links This section mandates specific behaviour for the "up" link relation, but does not define that link relation (see [RFC8288]). The specific behaviour is for the RDAP INR context only, though, and in that context it does not conflict with the current description of that link relation. 4. Responding To Searches As with [RFC9083], responses to the IP network and autonomous system number searches defined in the previous sections take the form of an array of object instances, where each instance is an appropriate object class for the search (i.e., a search beginning with /ips yields an array of IP network object instances, and a search beginning with /autnums yields an array of autonomous system number object instances). These arrays are contained within the response object. The names of the arrays are as follows: for /ips searches, the array is "ipSearchResults"; and for /autnums searches, the array is "autnumSearchResults". Responses for relation searches for reverse domain objects have the same form as for a standard domain search response, per [RFC9083]. Harrison & Singh Expires 3 November 2023 [Page 10] Internet-Draft RDAP RIR Search May 2023 5. Reverse Search RDAP reverse search is defined by [I-D.ietf-regext-rdap-reverse-search]. That document limits reverse search to domains, nameservers, and entities. This document extends reverse search to cover IP networks and autonomous system numbers as well. If a server receives a reverse search query with a searchable resource type (per the definition of that term in [I-D.ietf-regext-rdap-reverse-search]) of "ips", then the reverse search will be performed on the IP network objects from its data store. Similarly, if a server receives a reverse search query with a searchable resource type of "autnums", then the reverse search will be performed on the autonomous system number objects from its data store. Additionally, Section 9 includes requests to register new entries for IP network and autonomous system number searches in the RDAP Reverse Search and RDAP Reverse Search Mapping IANA registries. 6. RDAP Conformance A server that supports the functionality specified in this document MUST include the string literal "rir_search" in the rdapConformance array in their response objects. [RFC7480], [RFC9082] and [RFC9083] collectively require that an RDAP extension identifier be used as a prefix in new path segments and response object members that are introduced by the extension. Because IP network objects and autonomous system number objects are part of the original set of object types defined for use in RDAP, it may be unintuitive or confusing for users if the basic searches and associated responses defined here include the "rir_search" extension prefix, since the searches and associated responses for the other original object types do not include a prefix. Therefore, the extension identifier is not used as a prefix in this document. It is not expected that this will cause any problems for RDAP clients or similar. The relation searches do make use of the extension identifier, though, because no similar searches are defined in those original RDAP documents. Harrison & Singh Expires 3 November 2023 [Page 11] Internet-Draft RDAP RIR Search May 2023 7. Privacy Considerations The search functionality defined in this document may affect the privacy of entities in the registry (and elsewhere) in various ways: see [RFC6973] for a general treatment of privacy in protocol specifications. Server operators should be aware of the tradeoffs that result from implementation of this functionality. Many jurisdictions have laws or regulations that restrict the use of "Personal Data", per the definition in [RFC6973]. Given that, server operators should ascertain whether the regulatory environment in which they operate permits implementation of the functionality defined in this document. 8. Security Considerations [RFC7481] describes security requirements and considerations for RDAP generally. 9. IANA Considerations IANA is requested to register the following value in the RDAP Extensions Registry: * Extension identifier: rir_search * Registry operator: Any * Published specification: [this document] * Contact: IETF * Intended usage: This extension identifier is used for INR-specific search operations. IANA is also requested to register the following values in the Link Relations Registry: * Relation Name: up-active * Description: Refers to an RDAP parent document that has a status of "active" in a hierarchy of documents. * Reference: [this document] * Relation Name: down Harrison & Singh Expires 3 November 2023 [Page 12] Internet-Draft RDAP RIR Search May 2023 * Description: Refers to a set of child documents in a hierarchy of documents. * Reference: [this document] * Relation Name: top * Description: Refers to the topmost parent document in a hierarchy of documents. * Reference: [this document] * Relation Name: top-active * Description: Refers to the topmost RDAP parent document that has a status of "active" in a hierarchy of documents. * Reference: [this document] * Relation Name: bottom * Description: Refers to the set of child documents that do not themselves have child documents, in a hierarchy of documents. * Reference: [this document] IANA is also requested to register the following entries in the "RDAP Reverse Search" registry: Searchable Resource Type: ips, autnums Related Resource Type: entity Property: fn Description: The server supports the IP/autnum search based on the full name (a.k.a formatted name) of an associated entity. Registrant Name: IESG Registrant Contact Information: iesg@ietf.org Reference: This document. Searchable Resource Type: ips, autnums Related Resource Type: entity Harrison & Singh Expires 3 November 2023 [Page 13] Internet-Draft RDAP RIR Search May 2023 Property: handle Description: The server supports the IP/autnum search based on the handle of an associated entity. Registrant Name: IESG Registrant Contact Information: iesg@ietf.org Reference: This document. Searchable Resource Type: ips, autnums Related Resource Type: entity Property: email Description: The server supports the IP/autnum search based on the email address of an associated entity. Registrant Name: IESG Registrant Contact Information: iesg@ietf.org Reference: This document. Searchable Resource Type: ips, autnums Related Resource Type: entity Property: role Description: The server supports the IP/autnum search based on the role of an associated entity. Registrant Name: IESG Registrant Contact Information: iesg@ietf.org Reference: This document. IANA is also requested to register the following entries in the "RDAP Reverse Search Mapping" registry: Searchable Resource Type: ips, autnums Related Resource Type: entity Harrison & Singh Expires 3 November 2023 [Page 14] Internet-Draft RDAP RIR Search May 2023 Property: fn Property Path: $..entities[*].vcardArray[1][?(@[0]=='fn')][3] Registrant Name: IESG Registrant Contact Information: iesg@ietf.org Reference: This document. Searchable Resource Type: ips, autnums Related Resource Type: entity Property: handle Property Path: $..entities[*].handle Registrant Name: IESG Registrant Contact Information: iesg@ietf.org Reference: This document. Searchable Resource Type: ips, autnums Related Resource Type: entity Property: email Property Path: $..entities[*].vcardArray[1][?(@[0]=='email')][3] Registrant Name: IESG Registrant Contact Information: iesg@ietf.org Reference: This document. Searchable Resource Type: ips, autnums Related Resource Type: entity Property: role Property Path: $..entities[*].roles Registrant Name: IESG Harrison & Singh Expires 3 November 2023 [Page 15] Internet-Draft RDAP RIR Search May 2023 Registrant Contact Information: iesg@ietf.org Reference: This document. 10. Acknowledgements The authors wish to thank Mario Loffredo, Andy Newton, and Antoin Verschuren for document review and associated comments. 11. References 11.1. Normative References [I-D.ietf-regext-rdap-reverse-search] Loffredo, M. and M. Martinelli, "Registration Data Access Protocol (RDAP) Reverse Search", Work in Progress, Internet-Draft, draft-ietf-regext-rdap-reverse-search-21, 17 April 2023, . [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, . [RFC7481] Hollenbeck, S. and N. Kong, "Security Services for the Registration Data Access Protocol (RDAP)", STD 95, RFC 7481, DOI 10.17487/RFC7481, March 2015, . [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, . [RFC9082] Hollenbeck, S. and A. Newton, "Registration Data Access Protocol (RDAP) Query Format", STD 95, RFC 9082, DOI 10.17487/RFC9082, June 2021, . [RFC9083] Hollenbeck, S. and A. Newton, "JSON Responses for the Registration Data Access Protocol (RDAP)", STD 95, RFC 9083, DOI 10.17487/RFC9083, June 2021, . [RFC9110] Fielding, R., Ed., Nottingham, M., Ed., and J. Reschke, Ed., "HTTP Semantics", STD 97, RFC 9110, DOI 10.17487/RFC9110, June 2022, . Harrison & Singh Expires 3 November 2023 [Page 16] Internet-Draft RDAP RIR Search May 2023 11.2. Informative References [RFC6973] Cooper, A., Tschofenig, H., Aboba, B., Peterson, J., Morris, J., Hansen, M., and R. Smith, "Privacy Considerations for Internet Protocols", RFC 6973, DOI 10.17487/RFC6973, July 2013, . [RFC7480] Newton, A., Ellacott, B., and N. Kong, "HTTP Usage in the Registration Data Access Protocol (RDAP)", STD 95, RFC 7480, DOI 10.17487/RFC7480, March 2015, . [RFC8288] Nottingham, M., "Web Linking", RFC 8288, DOI 10.17487/RFC8288, October 2017, . Authors' Addresses Tom Harrison Asia Pacific Network Information Centre 6 Cordelia St South Brisbane QLD 4101 Australia Email: tomh@apnic.net Jasdip Singh American Registry for Internet Numbers PO Box 232290 Centreville, VA 20120 United States of America Email: jasdips@arin.net Harrison & Singh Expires 3 November 2023 [Page 17]