Subject: Re: [weirds] WEIRDS inactivity, and issues raised in London

From: Maarten Bosteels <[email-masked]>
Date: Thu, 21 Aug 2014 14:20:58 +0000

On 30/07/14 20:22, "Andrew Sullivan" <[email-masked]> wrote:

>On Wed, Jul 30, 2014 at 03:51:34PM +0000, Maarten Bosteels wrote:
>> 
>> I agree that 404 is not an appropriate response to a request containing
>>a
>> syntactically invalid domain name.
>
>I worry that I'm not sure what "syntactically invalid domain name" is
>in that sentence.
>
>Keep in mind that "‘’„‼※⁙⁕" (without the ASCII quotes -- those are all
>Unicode code points in the punctuation category, so they should all be
>DISALLOWED under IDNA2008) is a perfectly legal DNS label.  It is
>clearly not a conforming LDH-label, it is not a U-label because it
>cannot be converted to an A-label, but it _can_ be represented in
>IDNA2003 (the Punycode output is dvgcp0je5m1a, so the IDNA2003 label
>is xn--dvgcp0je5m1a).  Which of these do you mean?

I agree that "syntactically invalid domain name" is too vague.

I suggest to refer to the definition of "IDN aware domain name slot"
and the definition of "Internationalized Domain Name" as defined in RFC
5890.

  An "internationalized domain name" (IDN) is a domain name that contains
at least one A-label or U-label, but that otherwise may
  contain any mixture of NR-LDH labels, A-labels, or U-labels.

Is RDAP supposed to support both IDNA2003 and IDNA2008 ?  That seems to be
asking for trouble.

Would it be too restricting for RDAP to only support "Internationalized
Domain Name" as defined in RFC 5890
and thus not, for example, Unicode code points in the punctuation category
nor underscore labels.

>
>> And *if* we think skipping or avoiding validation is useful, why do we
>> specify that the server MUST convert to U-label format and do the lookup
>> by A-label ?
>
>This is because, if you're doing IDNA, you're publishing A-labels in
>the DNS.  There was an early assumption that what you should be able
>to look up in the RDAP is the name from the DNS, and if it's a U-label
>is will _never_ be in that format in the DNS.

OK, I must have missed that. I don't really understand that assumption.
ACE notation was invented for protocols like DNS that only support ASCII,
but RDAP is a new protocol ...

> 
>
>My own view, for what it's worth, is that a server needs to use either
>A-label or U-label form, and always use it.  There are a lot of
>possible pitfalls in U-label forms, however, and several people said
>that client-side mapping was not going to work.  In that case, you
>might well get a U-label that is not the right one someone was looking
>for, and it'd be good to be able to throw an error for "bad U-label"
>as opposed to "no match".

So you agree that a 404 would not be ideal for input which is not an
"Internationalized Domain Name" ?

Best regards

Maarten
--
[email-masked]

>
>> One of the benefits of IDNA2008 is that you can safely convert from
>> U-label to A-label and back again, so you could as well do an exact
>>match
>> on U-label (given that it is a valid U-label).
>
>That is true.  But just as true is that you can convert.
>
>Best regards,
>
>A
>-- 
>Andrew Sullivan
>[email-masked]
>
>_______________________________________________
>weirds mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/weirds

---

From: Andrew Sullivan <[email-masked]>
Date: Thu, 21 Aug 2014 10:48:37 -0400

> and the definition of "Internationalized Domain Name" as defined in RFC

That'd be ok with me.

> Is RDAP supposed to support both IDNA2003 and IDNA2008 ?  That seems to be

There are registries supporting IDNA2003, however.  What is one to do
about them?

> but RDAP is a new protocol ...

DNS does not only support ASCII.  It just turned out that it was
easier to do LDH-conforming than to violate the established
conventions.  But you're right that ACE is a backward-compatibility
hack.

The thing is, RDAP is a new protocol that is supposed to provide
information about that other protocol, and so presumably needs to be
compatible with the same backward-compatibility hack.

The only thing I actually care about is that a given repository always
uses one form or the other.  I think mixing A-labels and U-labels is a
road to madness.

> "Internationalized Domain Name" ?

I don't see why.  "Not Found" is correct, no?

A

-- 
Andrew Sullivan
[email-masked]

---

From: Maarten Bosteels <[email-masked]>
Date: Thu, 21 Aug 2014 15:20:51 +0000

>There are registries supporting IDNA2003, however.  What is one to do

Well, RDAP is already referencing the IDNA2008 RFC's and terminology
(A-label and U-label is pure IDNA2008)
so I guess they already have that problem. Migrating from IDNA2003 to
IDNA2008 is certainly not impossible, it has already been done (by .de for
example).

>uses one form or the other.  I think mixing A-labels and U-labels is a

You mean mixing of both representations in one domain name ?
Sorry, I still fail to see why it would lead to madness. The server should
simply treat the name label by label and convert to the preferred
representation.
And madness for whom ? The implementers of an RDAP server or the client ?
Or for the human users of an RDAP client ?

I agree that the response from the RDAP server should only use one format.

But when we assume that an RDAP client is capable of converting the input
from the user to either all A-labels or all U-labels
than we can also assume that it can ALWAYS use U-labels, no ?

And more importantly, what should the server do when it receives mixed
input ?
404 doesn't seem appropriate when the name is actually in the repository.

>I don't see why.  "Not Found" is correct, no?

Yes, it's correct.
But you wrote "it'd be good to be able to throw an error for "bad U-label"
as opposed to "no match"
With a 404 response you wouldn't be able to do that.

I agree that a binary approach (match or no match) is easier to implement,
especially server-side, but it might not be ideal for human users.

---

From: Andrew Sullivan <[email-masked]>
Date: Thu, 21 Aug 2014 12:35:56 -0400

> IDNA2008 is certainly not impossible, it has already been done (by .de for

That's a reasonable point.

> simply treat the name label by label and convert to the preferred

I mean both representations in one name, yes. 

> Or for the human users of an RDAP client ?

I think both.  I think it is entirely likely to result in bugs and
it's going to be unusable for humans.  I can see how one would do it,
but I think it will make a mess.  However,

> than we can also assume that it can ALWAYS use U-labels, no ?

…I seem to recall John Klensin arguing in Toronto that you can't
really require single-form input, because you don't know what it was
assembled from.  Maybe it has been assembled from other input, and it
might not have been normalized to U-label or A-label form.

> 404 doesn't seem appropriate when the name is actually in the repository.

That's a good point.

> With a 404 response you wouldn't be able to do that.

Clearly, I am too distracted to be thinking about this today, because
I do in fact recall saying that (and I still think it's true that it'd
be useful).

A

-- 
Andrew Sullivan
[email-masked]