Subject: Re: [mile] Documenting DomainData

From: Chris Inacio <[email-masked]>
Date: Tue, 4 Mar 2014 00:33:21 +0000

On Feb 3, 2014, at 2:21 AM, Roman D. Danyliw <[email-masked]> wrote:

> Hi Panos, et al!
>  
> Regardless of format, we need to document every record type listed in @RecordType to enumerate which fields from this record type will be supported, what representation will be used to store the field, and an appropriate RFC citation.
>  
> To the larger group, do we want a colon separated list, or since the data model is implemented in XML, individual classes to represent the fields (e.g.,  ApplicationHeaderType)?

That’s potentially a lot of record types.  And capturing things that are relevant to folks who actually spend their time analyzing DNS, they would want things like flags etc.  (Assuming that after sharing a report, someone might want to mine the shared indicators over some period of time to look for trends, for example.)

If you’re going to just separate with colons, are you going to create some type of shorthand type system for DNS records?

fqdn,mail1.example.com:ttl,1500:mxlevel,10:…

--
Chris Inacio
[email-masked]

>  
> Roman
>  
> From: Panos Kampanakis (pkampana) [mailto:[email-masked]] 
> Sent: Friday, January 24, 2014 4:18 PM
> To: Roman D. Danyliw; 'Moriarty, Kathleen'; [email-masked]
> Subject: RE: [mile] Documenting DomainData
>  
> I see your point now. Yes, we need to be as specific as possible.
>  
> We can format them using colons as separators as you used in your example following a simple pattern.  It can be
>  
> <owner>:< TTL>:<MX Level>:< Data>
>  
> The type is dictated by the RelatedDNS attribute and the class should be assumed as IN.
>  
> Panos
>  
>  
>  
> From: Roman D. Danyliw [mailto:[email-masked]] 
> Sent: Friday, January 24, 2014 1:03 PM
> To: Panos Kampanakis (pkampana); 'Moriarty, Kathleen'; [email-masked]
> Subject: RE: [mile] Documenting DomainData
>  
> Hello!
>  
> I concur that RelatedDNS contains related DNS records for the domain listed in DomainData/Name.  However, I don’t think we can be vague in describing the format of RelatedDNS.
>  
> The example shared by Kathleen’s had the following example of a MX record.
>  
> <iodef:RelatedDNS RecordType="MX">evildave.com MX prefernce = 10, mail exchanger = mail1.evildave.com</iodef:RelatedDNS>
>  
> I can infer the format.  However, without the draft providing guidance, the following could have also have been acceptable (replacing evildave.com for example.com):
>  
> <RelatedDNS RecordType="MX">mail1.org1.example.com</RelatedDNS>
> <RelatedDNS RecordType="MX">org1.example.com 4000 IN MX 10 mail1.org1.example.com</RelatedDNS>
> <RelatedDNS RecordType="MX">org1.example.com mail1.org1.example.com</RelatedDNS>
> <RelatedDNS RecordType="MX">@org1.example.com:10.1.2.3:mail1.org1.example.com:0:86400:329832:0</RelatedDNS>
>  
> I feel that we need to provide implementers unambiguous guidance if we expect them to parse the field.
>  
> Roman
>  
> From: Panos Kampanakis (pkampana) [mailto:[email-masked]] 
> Sent: Thursday, January 23, 2014 9:28 AM
> To: Roman D. Danyliw; 'Moriarty, Kathleen'; [email-masked]
> Subject: RE: [mile] Documenting DomainData
>  
> I think text that says “The RelatedDNS record contain DNS records (i.e. MX, A) that are related to the domain described in its parent DomainData class. For example, in DomainData class for domain example.com, the RelatedDNS record could be carrying the MX record for example.com.” would suffice.
> Panos
>  
> From: Roman D. Danyliw [mailto:[email-masked]] 
> Sent: Thursday, January 23, 2014 8:20 AM
> To: 'Moriarty, Kathleen'; [email-masked]
> Cc: Panos Kampanakis (pkampana)
> Subject: RE: [mile] Documenting DomainData
>  
> Hi Kathleen!
>  
> The example was very helpful.  Thank you.
>  
> For discussion purposes on the list, here is a relevant excerpt from the previously attached file:
> <iodef:DomainData>
> <iodef:Name>evildave.com</iodef:Name>
> <iodef:DateDomainWasChecked>2013-01-04T09:10:24+00:00</iodef:DateDomainWasChecked>
> <iodef:RelatedDNS RecordType="MX">evildave.com MX prefernce = 10, mail exchanger = mail1.evildave.com</iodef:RelatedDNS>
> <iodef:RelatedDNS RecordType="A">mail1.evildave.com internet address = 176.157.32.17</iodef:RelatedDNS>
> <iodef:RelatedDNS RecordType="SPF">zuesevil.com. IN TXT \"v=spf1 a mx –all\"</iodef:RelatedDNS>
> </iodef:DomainData>
>  
> Reading this particular example, I understand what information is being passed along in the DNS record.  Where I need help is how do we formally describe this format for the draft. 
>  
> Roman
>  
> From: Moriarty, Kathleen [mailto:[email-masked]] 
> Sent: Wednesday, January 22, 2014 6:50 PM
> To: Roman D. Danyliw; [email-masked]
> Cc: 'Panos Kampanakis (pkampana)' ([email-masked])
> Subject: RE: [mile] Documenting DomainData
>  
> Hi Roman,
>  
> I was able to dig up an example from the group that was proposing the addition of RelatedDNS to the DomainData class that was added from RFC5901.  Panos may have other examples planned for the IODEF Guidance document.
>  
> I think as long as the data of other records can be included, the intent will be met for the requestors.  See the attached example and I am sure a proposal that alters it, but provides the ability to include that information would be fine.
>  
> Anyone else?
>  
> Thanks,
> Kathleen
>  
>  
> From: Roman D. Danyliw [mailto:[email-masked]] 
> Sent: Monday, January 20, 2014 5:04 PM
> To: Moriarty, Kathleen; [email-masked]
> Subject: RE: [mile] Documenting DomainData
>  
> Hello!
>  
> Understood on #1 and #3.  I still need a little more clarification on your answer to question #2, “RelatedDNS lets you add any record type to expand out what is possible from the Domain data class.  You can also list what type of record you are including.”  To restate, RelatedDNS represents DNS records for a domain specified in DomainData/Name?  If so, what exactly goes into the element content of RelatedDNS which is defined as xs:string?  For example, if I had an AXFR record (<RelatedDNS RecordType=”AXRF”>) how would this be encoded?
>  
> Since Node/DomainData/DateDomainWasChecked represents when Node/DomainData/Name was resolved (where the IP address is stored in Node/Address), is there a similar construct for these other record types in RelatedDNS?
>  
> Roman
>  
> From: Moriarty, Kathleen [mailto:[email-masked]] 
> Sent: Monday, January 20, 2014 8:48 AM
> To: Roman D. Danyliw; [email-masked]
> Subject: RE: [mile] Documenting DomainData
>  
> Hi Roman,
>  
> #1 I thought the answer was yes, but it would be good to hear if anyone thinks it is too much detail now.
>  
> #2 RelatedDNS lets you add any record type to expand out what is possible from the Domain data class.  You can also list what type of record you are including.
>  
> #3 I don’t think there is a concern in adjusting the names for consistency.
>  
> Thanks,
> Kathleen
>  
> From: mile [mailto:[email-masked]] On Behalf Of Roman D. Danyliw
> Sent: Friday, January 17, 2014 9:32 PM
> To: [email-masked]
> Subject: [mile] Documenting DomainData
>  
> Hello!
>  
> Since being copied from RFC5901 into 5070bis, DomainData has evolved.  Currently the two definition differ as follows:
>  
> ** 5070bis added DomainData@{indicator-uid, indicator-set-id}
> ** 5070bis added DomainData/RelatedDNS
> ** 5070bis uses iodef:Contact for DomainData/DomainContacts/Contact instead of phish:Contact which added classes and attributes to Contact
>  
> A few questions:
>  
> (1) Since bits and pieces were added and modified in the cut-and-paste from 5901, is there agreement that we don’t need to remove anything from DomainData?  Do we want to represent this level of detail in the core IODEF data model?
>  
> (2) RelatedDNS was added to DomainData and is not present in RFC5901.  There is no descriptive text.  Could someone shed light on the purpose of this class.
>  
> (3) The attributes DomainData@{SystemStatus, DomainStatus} and RelatedDNS@RecordType don't follow the naming convention of lower case names separated by a hyphen.  As in other cases where classes have been moved, I would be inclined to rename the attributes.  Any concern in doing that?
>  
> Roman
> _______________________________________________
> mile mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mile