Subject: [regext] [RDAP] rdapConformance mandatory?

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 7 Jul 2020 15:07:26 +0200

I've found a RDAP client which crashes, apparently when there is no
rdapConformance in the answer.

RFC 7483 seems very liberal. It does not say that rdapConformance is
mandatory.

Any opinion, backed by chapter and verse of RFC 7483, about wether
this member is really necessary?

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Tue, 7 Jul 2020 14:05:45 +0000

> -----Original Message-----
> From: regext <[email-masked]> On Behalf Of Stephane
> Bortzmeyer
> Sent: Tuesday, July 7, 2020 9:07 AM
> To: [email-masked]
> Subject: [EXTERNAL] [regext] [RDAP] rdapConformance mandatory?
> 
> Any opinion, backed by chapter and verse of RFC 7483, about wether this
> member is really necessary?

Remember that we're working on 7483bis precisely because of issues like this. 7483 doesn't explicitly say that the structure is REQUIRED, but in my opinion it needs to be there so that clients know what to expect in terms of response data structures. 7483bis says this:

"This data structure MUST appear in the topmost JSON object of a response"

Scott

---

From: "Patrick Mevzek" <[email-masked]>
Date: Tue, 07 Jul 2020 10:34:13 -0500

> rdapConformance in the answer.

Poor client. I predict a very difficult time for it, as it will find many many different types of broken RDAP servers with much more difficult cases than this.
 
> RFC 7483 seems very liberal. It does not say that rdapConformance is

It says:
The string literal "rdap_level_0" signifies conformance with this
   specification.

Which for me implies that this string must be seen if one claims to be an RDAP server/client, and in turn this string happens to be defined inside the rdapConformance.

So, if no rdapConformance, no rdap_level_0, and hence no real RDAP but something else.

Also, RFC 7483 is not the only thing out there to watch for, specifically because it seems more is happening in gTLD than ccTLD world.
See §1.7 of https://www.icann.org/en/system/files/files/rdap-technical-implementation-guide-15feb19-en.pdf

<quote>
1.7. An ​rdapConformance​ object [​RFC7483​] MUST be present in the topmost object of every response, and it MUST contain the conformance level of the RDAP protocol and of any extensions, as specified in​​ RFC7483​.
</quote>

-- 
  Patrick Mevzek
  [email-masked]