| Registration Protocols Extensions | M. Loffredo |
| Internet-Draft | M. Martinelli |
| Intended status: Standards Track | IIT-CNR/Registro.it |
| Expires: December 20, 2018 | S. Hollenbeck |
| Verisign Labs | |
| June 18, 2018 |
Registration Data Access Protocol (RDAP) Query Parameters for Result Sorting and Paging
draft-loffredo-regext-rdap-sorting-and-paging-04
The Registration Data Access Protocol (RDAP) does not include core functionality for clients to provide sorting and paging parameters for control of large result sets. This omission can lead to unpredictable server processing of queries and client processing of responses. This unpredictability can be greatly reduced if clients can provide servers with their preferences for managing response values. This document describes RDAP query extensions that allow clients to specify their preferences for sorting and paging result sets.
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."
This Internet-Draft will expire on December 20, 2018.
Copyright (c) 2018 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
The availability of functionality for result sorting and paging provides benefits to both clients and servers in the implementation of RESTful services [REST]. These benefits include:
Approaches to implementing features for result sorting and paging can be grouped into two main categories:
However, there are some drawbacks associated with use of the HTTP header. First, the header properties cannot be set directly from a web browser. Moreover, in an HTTP session, the information on the status (i.e. the session identifier) is usually inserted in the header or in the cookies, while the information on the resource identification or the search type is included in the query string. The second approach is therefore not compliant with the HTTP standard [RFC7230]. As a result, this document describes a specification based on use of query parameters.
Currently the RDAP protocol [RFC7482] defines two query types:
While the lookup query does not raise issues in the management of large result sets, the search query can potentially generate a large result set that could be truncated according to the limits of the server. In addition, it is not possible to obtain the total number of the objects found that might be returned in a search query response [RFC7483]. Lastly, there is no way to specify sort criteria to return the most relevant objects at the beginning of the result set. Therefore, the client could traverse the whole result set to find the relevant objects or, due to truncation, could not find them at all.
The protocol described in this specification extends RDAP query capabilities to enable result sorting and paging, by adding new query parameters that can be applied to RDAP search path segments. The service is implemented using the Hypertext Transfer Protocol (HTTP) [RFC7230] and the conventions described in RFC 7480 [RFC7480].
The implementation of these parameters is technically feasible, as operators for counting, sorting and paging rows are currently supported by the major RDBMSs. Impact on the current state of RDAP implementation is estimated to be quite low.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119].
The new query parameters are OPTIONAL extensions of path segments defined in RFC 7482 [RFC7482]. They are as follows:
Augmented Backus-Naur Form (ABNF) [RFC5234] is used in the following sections to describe the formal syntax of these new parameters.
Except for sorting, the implementation of counting and paging requires servers to provide additional information in their responses. Such information is collected in a new data structure named "paging_metadata" which contains the following fields:
The "totalCount" field is provided if the query contains the "count" parameter. Anyway, servers MAY provide such information without implementing the "count" parameter.
The other fields appear when pagination occurs. In this specification, only the forward pagination is dealt because it is considered satisfactory in order to traverse the result set. If a server should also implement backward pagination, an appropriate field (e.g. "prevOffset") identifying the start of the previous page should be added.
FOR DISCUSSION: Should the metadata described in this specification be part of a more general "metadata" property including other contents (e.g rate limits, information about the server, information about the response)?
Currently the RDAP protocol does not allow a client to determine the total number of the results in a query response when the result set is truncated. This is rather inefficient because the user cannot evaluate the query precision and, at the same time, cannot receive information that could be relevant.
The new parameter "count" provides additional functionality (Figure 1) that allows a client to request information from the server that specifies the total number of elements matching a particular search pattern.
https://example.com/rdap/domains?name=*nr.com&count=true
Figure 1: Example of RDAP query reporting the count parameter
The ABNF syntax is the following:
A trueValue means that the server MUST provide the total number of the objects in the "totalCount" field of the "paging_metadata" data structure (Figure 2). A falseValue means that the server MUST NOT provide this number.
{
"rdapConformance": [
"rdap_level_0",
"paging_level_0"
],
...
"paging_metadata": {
"totalCount": 73
},
"domainSearchResults": [
...
]
}
Figure 2: Example of RDAP response with "paging_metadata" data structure containing the "totalCount" field
The RDAP protocol does not provide any capability to specify response value sort criteria. A server could implement a default sorting scheme according to the object class, but this feature is not mandatory and might not meet user requirements. Sorting can be addressed by the client, but this solution is rather inefficient. Sorting and paging features provided by the DBMS used by the RDAP server could help avoid truncation of relevant results and allow for scrolling the result set using subsequent queries.
The "sortby" parameter allows the client to ask the server to sort the results according to the values of one or more properties and according to the sort direction of each property. The ABNF syntax is the following:
"a" means that the ascending sort MUST be applied, "d" means that the descending sort MUST be applied. If the sort direction is absent, an ascending sort MUST be applied (Figure 3).
In the sortby ABNF syntax, property-ref represents a reference to a property of an RDAP object. Such a reference could be expressed by using a JSON Path. The JSON Path in a JSON document [RFC8259] is equivalent to the XPath [W3C.CR-xpath-31-20161213] in a XML document. For example, the JSON Path to select the value of the ldhName property inside an RDAP domain object is "$.ldhName", where $ identifies the root of the document (DOM). Another way to select a value inside a JSON document is the JSON Pointer [RFC6901]. While JSON Path or JSON Pointer are both standard ways to select any value inside JSON data, neither is particularly easy to use (e.g. "$.events[?(@.eventAction='registration')].eventDate" is the JSON Path expression of the registration date in a RDAP domain object).
Therefore, this specification provides a definition of property-ref in terms of RDAP properties. However, not all the RDAP properties are suitable to be used in sort criteria, such as:
On the contrary, some properties expressed as values of other properties (e.g. registration date) could be used in such a context.
In the following, a list of the proposed properties for sort criteria is presented. The properties are divided in two groups: object common properties and object specific properties.
In the following, the correspondence between the values of sortby parameter and the RDAP object properties is shown (Table 1):
| Object class | sortby value | Object property | Reference in RFC 7483 | Reference in RFC 6350 |
|---|---|---|---|---|
| Searchable objects | Common properties | eventAction values suffixed by "Date" | 4.5. | |
| Domain | ldhName | ldhName | 5.3. | |
| Nameserver | ldhName | ldhName | 5.2. | |
| ipV4 | v4 ipAddress | 5.2. | ||
| ipV6 | v6 ipAddress | 5.2. | ||
| Entity | handle | handle | 5.1. | |
| fn | vcard fn | 5.1. | 6.2.1 | |
| org | vcard org | 5.1. | 6.6.4 | |
| tel | vcard tel with type="voice" | 5.1. | 6.4.1 | |
| vcard email | 5.1. | 6.4.2 | ||
| country | country code (as given in ISO.3166.1988 [ISO.3166.1988]) of the country name in vcard adr | 5.1. | 6.3.1 | |
| countryName | country name in vcard adr | 5.1. | 6.3.1 | |
| locality | locality in vcard adr | 5.1. | 6.3.1 |
With regard to the definitions in Table 1, some further considerations must be made to disambiguate cases where the RDAP object property is multivalued:
Each RDAP provider MAY define other sorting properties than those shown in this document. (FOR DISCUSSION: how should those properties be defined? Is an IANA registry appropriate?)
https://example.com/rdap/domains?name=*nr.com&sortby=ldhName
https://example.com/rdap/domains?name=*nr.com&sortby=registrationDate:d
https://example.com/rdap/domains?name=*nr.com&sortby=lockedDate,ldhName
Figure 3: Examples of RDAP query reporting the sortby parameter
An RDAP query could return a response with hundreds of objects, especially when partial matching is used. For that reason, two parameters addressing result pagination are defined to make responses easier to handle:
The ABNF syntax is the following:
When limit and offset are used together, they allow implementation of result pagination. The following examples illustrate requests to return, respectively, the first 5 objects, the set of objects starting from position 6, and first 5 objects starting from position 11 of the result set (Figure 4).
https://example.com/rdap/domains?name=*nr.com&limit=5
https://example.com/rdap/domains?name=*nr.com&offset=5
https://example.com/rdap/domains?name=*nr.com&limit=5&offset=10
Figure 4: Examples of RDAP query reporting the limit and offset parameters
An RDAP server MAY use the "links" array of the "paging_metadata" data structure to provide a ready-made reference [RFC8288] to the next page of the result set (Figure 5). Examples of additional "rel" values are "first", "last", "prev".
{
"rdapConformance": [
"rdap_level_0",
"paging_level_0"
],
...
"notices": [
{
"title": "Search query limits",
"type": "result set truncated due to excessive load",
"description": [
"search results for domains are limited to 10"
]
}
],
"paging_metadata": {
"totalCount": 73,
"pageCount": 10,
"offset" : 10,
"nextOffset" : 20,
"links": [
{
"value": "https://example.com/rdap/domains?name=*nr.com",
"rel": "next",
"href": "https://example.com/rdap/domains?name=*nr.com&limit=10
&offset=10",
"title": "Result Pagination Link",
"type": "application/rdap+json"
}
]
},
"domainSearchResults": [
...
]
}
Figure 5: Example of a "paging_metadata" instance to implement result pagination based on offset and limit
The value constraints for the parameters are defined by their ABNF syntax. Therefore, each request providing an invalid value for a parameter SHOULD obtain an HTTP 400 (Bad Request) response code. The same response SHOULD be returned if the client provides an unsupported value for the sortby parameter in both single and multi sort.
The server can provide a different response when it supports the limit and/or offset parameters and the client submits values that are out of the valid ranges. The possible cases are:
Optionally, the response MAY include additional information regarding the negative answer in the HTTP entity body.
Servers returning the "paging_metadata" data structure in their responses MUST include "paging_level_0" in the rdapConformance array.
The implementation of the new parameters is technically feasible, as operators for counting, sorting and paging are currently supported by the major RDBMSs.
In the following, the match between the new defined parameters and the SQL operators is shown (Table 2):
| New query parameter | SQL operator |
|---|---|
| count | count(*) query without offset, limit and order by |
| [MYSQL-COUNT],[POSTGRES-COUNT],[ORACLE-COUNT] | |
| sortby | order by |
| [MYSQL-SORT],[POSTGRES-SORT],[ORACLE-SORT] | |
| limit | limit n (in MySql [MYSQL-LIMIT] and Postgres [POSTGRES-LIMIT]) |
| FETCH FIRST n ROWS ONLY (in Oracle [ORACLE-LIMIT]) | |
| offset | offset m (in Postgres) |
| OFFSET m ROWS (in Oracle) | |
| limit + offset | limit n offset m (in MySql and Postgres) |
| OFFSET m ROWS FETCH NEXT n ROWS ONLY (in Oracle) |
With regard to Oracle, Table 2 reports only one of the three methods that can be used to implement limit and offset parameters. The others are described in [ORACLE-ROWNUM] and [ORACLE-ROW-NUMBER].
In addition, similar operators are completely or partially supported by the most known NoSQL databases (MongoDB, CouchDB, HBase, Cassandra, Hadoop) so the implementation of the new parameters seems to be practicable by servers working without the use of an RDBMS.
The use of limit and offset operators represents the most common way to implement results pagination. However, when offset has a high value, scrolling the result set could take some time. In addition, offset pagination may return inconsistent pages when data are frequently updated (i.e. real-time data) but this is not the case of registration data. An alternative approach to offset pagination is the keyset pagination, a.k.a. seek-method [SEEK] or cursor based pagination. This method has been taken as the basis for the implementation of a cursor parameter [CURSOR] by some REST API providers (e.g. [CURSOR-API1],[CURSOR-API2]). The cursor parameter is an opaque URL-safe string representing a logical pointer to the first result of the next page (Figure 6).
{
"rdapConformance": [
"rdap_level_0",
"paging_level_0"
],
...
"notices": [
{
"title": "Search query limits",
"type": "result set truncated due to excessive load",
"description": [
"search results for domains are limited to 10"
]
}
],
"paging_metadata": {
"totalCount": 73,
"pageCount": 10,
"links": [
{
"value": "https://example.com/rdap/domains?name=*nr.com",
"rel": "next",
"href": "https://example.com/rdap/domains?name=*nr.com&limit=10
&cursor=wJlCDLIl6KTWypN7T6vc6nWEmEYe99Hjf1XY1xmqV-M=",
"title": "Result Pagination Link",
"type": "application/rdap+json"
}
]
},
"domainSearchResults": [
...
]
}
Figure 6: Example of a "paging_metadata" instance to implement keyset pagination
But keyset pagination raises some drawbacks with respect to offset pagination:
Furthermore, in the RDAP context, some additional considerations can be made:
Finally, the keyset pagination is not fully compliant with the additional RDAP capabilities proposed by this document. In fact, the presence of a possible cursor parameter does not seem to be consistent with both the sorting capability and the possibility to implement additional ready-made links besides the classic "next page" link. But, while the provisioning of more paging links can be superfluous, dropping the sorting capability seems quite unreasonable.
If pagination is implemented by using a cursor, both "offset" and "nextOffset" fields are not included in the "paging_metadata" data structure.
FOR DISCUSSION: Should RDAP specification reports both offset and cursor parameters and let operators to implement pagination according to their needs, the user access levels, the submitted queries?
NOTE: Please remove this section and the reference to RFC 7942 prior to publication as an RFC.
This section records the status of known implementations of the protocol defined by this specification at the time of posting of this Internet-Draft, and is based on a proposal described in RFC 7942 [RFC7942]. The description of implementations in this section is intended to assist the IETF in its decision processes in progressing drafts to RFCs. Please note that the listing of any individual implementation here does not imply endorsement by the IETF. Furthermore, no effort has been spent to verify the information presented here that was supplied by IETF contributors. This is not intended as, and must not be construed to be, a catalog of available implementations or their features. Readers are advised to note that other implementations may exist.
According to RFC 7942, "this will allow reviewers and working groups to assign due consideration to documents that have the benefit of running code, which may serve as evidence of valuable experimentation and feedback that have made the implemented protocols more mature. It is up to the individual working groups to use this information as they see fit".
FOR DISCUSSION: An IANA-maintained registry could be used to document all of the properties that could be used as sort criteria. Such a registry could also be used to identify the properties for RDAP query filtering capabilities.
Entries in this registry could contain the following:
In the following, an example of the entry about the reference "ipV4" is reported:
Security services for the operations specified in this document are described in RFC 7481 [RFC7481].
Search query typically requires more server resources (such as memory, CPU cycles, and network bandwidth) when compared to lookup query. This increases the risk of server resource exhaustion and subsequent denial of service due to abuse. This risk can be mitigated by either restricting search functionality and limiting the rate of search requests. Servers can also reduce their load by truncating the results in the response. However, this last security policy can result in a higher inefficiency if the RDAP server does not provide any functionality to return the truncated results.
The new parameters presented in this document provide the RDAP operators with a way to implement a secure server without penalizing its efficiency. The "count" parameter gives the user a measure to evaluate the query precision and, at the same time, return a significant information. The "sortby" parameter allows the user to obtain the most relevant information at the beginning of the result set. In both cases, the user doesn't need to submit further unnecessary search requests. Finally, the "limit" and "offset" parameters enable the user to scroll the result set by submitting a sequence of sustainable queries according to the server limits.
The authors would like to acknowledge Brian Mountford for his contribution to the development of this document.