1// Package rdap is a basic client for checking the age of domains through RDAP.

2package rdap

3

4import (

5 "context"

6 "encoding/json"

7 "errors"

8 "fmt"

9 "io"

10 "net/http"

11 "slices"

12 "sort"

13 "strings"

14 "time"

15

16 "github.com/mjl-/mox/dns"

17 "github.com/mjl-/mox/mlog"

18)

19

20var ErrNoRegistration = errors.New("registration date not found")

21var ErrNoRDAP = errors.New("rdap not available for top-level domain")

22var ErrNoDomain = errors.New("domain not found in registry")

23var ErrSyntax = errors.New("bad rdap response syntax")

24

25// https://www.iana.org/assignments/rdap-dns/rdap-dns.xhtml

26// ../rfc/9224:115

27const rdapBoostrapDNSURL = "https://data.iana.org/rdap/dns.json"

28

29// Example data: ../rfc/9224:192

30

31// Bootstrap data, parsed from JSON at the IANA DNS bootstrap URL.

32type Bootstrap struct {

33 Version string `json:"version"` // Should be "1.0".

34 Description string `json:"description"`

35 Publication time.Time `json:"publication"` // RFC3339

36

37 // Each entry has two elements: First a list of TLDs, then a list of RDAP service

38 // base URLs ending with a slash.

39 Services [][2][]string `json:"services"`

40}

41

42// todo: when using this more regularly in the admin web interface, store the iana bootstrap response in a database file, including cache-controle results (max-age it seems) and the etag, and do conditional requests when asking for a new version. same for lookups of domains at registries.

43

44// LookupLastDomainRegistration looks up the most recent (re)registration of a

45// domain through RDAP.

46//

47// Not all TLDs have RDAP services yet at the time of writing.

48func LookupLastDomainRegistration(ctx context.Context, log mlog.Log, dom dns.Domain) (time.Time, error) {

49 // ../rfc/9224:434 Against advice, we do not cache the bootstrap data. This is

50 // currently used by the quickstart, which is run once, or run from the cli without

51 // a place to keep state.

52 req, err := http.NewRequestWithContext(ctx, "GET", rdapBoostrapDNSURL, nil)

53 if err != nil {

54 return time.Time{}, fmt.Errorf("new request for iana dns bootstrap data: %v", err)

55 }

56 // ../rfc/9224:588

57 req.Header.Add("Accept", "application/json")

58 resp, err := http.DefaultClient.Do(req)

59 if err != nil {

60 return time.Time{}, fmt.Errorf("http get of iana dns bootstrap data: %v", err)

61 }

62 defer func() {

63 err := resp.Body.Close()

64 log.Check(err, "closing http response body")

65 }()

66 if resp.StatusCode/100 != 2 {

67 return time.Time{}, fmt.Errorf("http get resulted in status %q, expected 200 ok", resp.Status)

68 }

69 var bootstrap Bootstrap

70 if err := json.NewDecoder(resp.Body).Decode(&bootstrap); err != nil {

71 return time.Time{}, fmt.Errorf("%w: parsing iana dns bootstrap data: %v", ErrSyntax, err)

72 }

73

74 // Note: We don't verify version numbers. If the format change incompatibly,

75 // decoding above would have failed. We'll try to work with what we got.

76

77 // ../rfc/9224:184 The bootstrap JSON has A-labels we must match against.

78 // ../rfc/9224:188 Names are lower-case, like our dns.Domain.

79 var urls []string

80 var tldmatch string

81 for _, svc := range bootstrap.Services {

82 for _, s := range svc[0] {

83 // ../rfc/9224:225 We match the longest domain suffix. In practice, there are

84 // currently only single labels, top level domains, in the bootstrap database.

85 if len(s) > len(tldmatch) && (s == dom.ASCII || strings.HasSuffix(dom.ASCII, "."+s)) {

86 urls = svc[1]

87 tldmatch = s

88 }

89 }

90 }

91 // ../rfc/9224:428

92 if len(urls) == 0 {

93 return time.Time{}, ErrNoRDAP

94 }

95 // ../rfc/9224:172 We must try secure transports before insecure (https before http). In practice, there is just a single https URL.

96 sort.Slice(urls, func(i, j int) bool {

97 return strings.HasPrefix(urls[i], "https://")

98 })

99 var lastErr error

100 for _, u := range urls {

101 var reg time.Time

102 reg, lastErr = rdapDomainRequest(ctx, log, u, dom)

103 if lastErr == nil {

104 return reg, nil

105 }

106 }

107 return time.Time{}, lastErr

108}

109

110// ../rfc/9083:284 We must match json fields case-sensitively, so explicitly.

111// Example domain object: ../rfc/9083:945

112

113// Domain is the RDAP response for a domain request.

114//

115// More fields are available in RDAP responses, we only parse the one(s) a few.

116type Domain struct {

117 // ../rfc/9083:1172

118

119 RDAPConformance []string `json:"rdapConformance"` // E.g. "rdap_level_0"

120 LDHName string `json:"ldhName"` // Domain.

121 Events []Event `json:"events"`

122}

123

124// Event is a historic or future change to the domain.

125type Event struct {

126 // ../rfc/9083:573

127

128 EventAction string `json:"eventAction"` // Required. See https://www.iana.org/assignments/rdap-json-values/rdap-json-values.xhtml.

129 EventDate time.Time `json:"eventDate"` // Required. RFC3339. May be in the future, e.g. date of expiry.

130}

131

132// rdapDomainRequest looks up a the most recent registration time of a at an RDAP

133// service base URL.

134func rdapDomainRequest(ctx context.Context, log mlog.Log, rdapURL string, dom dns.Domain) (time.Time, error) {

135 // ../rfc/9082:316

136 // ../rfc/9224:177 base URLs have a trailing slash.

137 rdapURL += "domain/" + dom.ASCII

138 req, err := http.NewRequestWithContext(ctx, "GET", rdapURL, nil)

139 if err != nil {

140 return time.Time{}, fmt.Errorf("making http request for rdap service: %v", err)

141 }

142 // ../rfc/9083:2372 ../rfc/7480:273

143 req.Header.Add("Accept", "application/rdap+json")

144 // ../rfc/7480:319 Redirects are handled by net/http.

145 resp, err := http.DefaultClient.Do(req)

146 if err != nil {

147 return time.Time{}, fmt.Errorf("http domain rdap get request: %v", err)

148 }

149 defer func() {

150 err := resp.Body.Close()

151 log.Check(err, "closing http response body")

152 }()

153

154 switch {

155 case resp.StatusCode == http.StatusNotFound:

156 // ../rfc/7480:189 ../rfc/7480:359

157 return time.Time{}, ErrNoDomain

158

159 case resp.StatusCode/100 != 2:

160 // We try to read an error message, perhaps a bit too hard, but we may still

161 // truncate utf-8 in the middle of a rune...

162 var msg string

163 var response struct {

164 // For errors, optional fields.

165 Title string `json:"title"`

166 Description []string `json:"description"`

167 // ../rfc/9083:2123

168 }

169 buf, err := io.ReadAll(io.LimitReader(resp.Body, 100*1024))

170 if err != nil {

171 msg = fmt.Sprintf("(error reading response: %v)", err)

172 } else if err := json.Unmarshal(buf, &response); err == nil && (response.Title != "" || len(response.Description) > 0) {

173 s := response.Title

174 if s != "" && len(response.Description) > 0 {

175 s += "; "

176 }

177 s += strings.Join(response.Description, " ")

178 if len(s) > 200 {

179 s = s[:150] + "..."

180 }

181 msg = fmt.Sprintf("message from remote: %q", s)

182 } else {

183 var s string

184 if len(buf) > 200 {

185 s = string(buf[:150]) + "..."

186 } else {

187 s = string(buf)

188 }

189 msg = fmt.Sprintf("raw response: %q", s)

190 }

191 return time.Time{}, fmt.Errorf("status %q, expected 200 ok: %s", resp.Status, msg)

192 }

193

194 var domain Domain

195 if err := json.NewDecoder(resp.Body).Decode(&domain); err != nil {

196 return time.Time{}, fmt.Errorf("parse domain rdap response: %v", err)

197 }

198

199 sort.Slice(domain.Events, func(i, j int) bool {

200 return domain.Events[i].EventDate.Before(domain.Events[j].EventDate)

201 })

202

203 now := time.Now()

204 for _, ev := range slices.Backward(domain.Events) {

205

206 if ev.EventDate.After(now) {

207 continue

208 }

209 switch ev.EventAction {

210 // ../rfc/9083:2690

211 case "registration", "reregistration", "reinstantiation":

212 return ev.EventDate, nil

213 }

214 }

215 return time.Time{}, ErrNoRegistration

216}

217