Merge branch 'master' of github.com:adulau/pdns-qof

Conflicts:
	i-d/pdns-qof.xml

i-d/pdns-qof.txt

@@ -14,7 +14,7 @@ Expires: June 28, 2014                                           CERT.at
 
 
                    Passive DNS - Common Output Format
-                 draft-ietf-dulaunoy-kaplan-pdns-cof-01
+                 draft-ietf-dulaunoy-passive-dns-cof-00
 
 Abstract
 
@@ -82,30 +82,30 @@ Table of Contents
        3.4.1.  sensor_id . . . . . . . . . . . . . . . . . . . . . .   5
        3.4.2.  zone_time_first . . . . . . . . . . . . . . . . . . .   5
        3.4.3.  zone_time_last  . . . . . . . . . . . . . . . . . . .   6
+     3.5.  Additional Fields Registry  . . . . . . . . . . . . . . .   6
    4.  Acknowledgements  . . . . . . . . . . . . . . . . . . . . . .   6
    5.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   6
    6.  Security Considerations . . . . . . . . . . . . . . . . . . .   6
    7.  References  . . . . . . . . . . . . . . . . . . . . . . . . .   6
      7.1.  Normative References  . . . . . . . . . . . . . . . . . .   6
      7.2.  References  . . . . . . . . . . . . . . . . . . . . . . .   7
-     7.3.  Informative References  . . . . . . . . . . . . . . . . .   7
+     7.3.  Informative References  . . . . . . . . . . . . . . . . .   8
-   Appendix A.  Appendix . . . . . . . . . . . . . . . . . . . . . .   7
+   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .   8
-   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .   7
 
 1.  Introduction
 
    Passive DNS is a technique described by Florian Weimer in 2005 in
    Passive DNS replication, F Weimer - 17th Annual FIRST Conference on
-   Computer Security.  Since then multiple Passive DNS implementations
+   Computer Security [WEINERPDNS].  Since then multiple Passive DNS
-   evolved over time.  Users of these Passive DNS servers query a server
+   implementations evolved over time.  Users of these Passive DNS
-   (often via WHOIS [RFC3912] or HTTP REST [REST]), parse the results
+   servers query a server (often via WHOIS [RFC3912] or HTTP REST
-   and process them in other applications.
+   [REST]), parse the results and process them in other applications.
 
    There are multiple implementation of Passive DNS software.  Users of
    passive DNS query each implementation and aggregate the results for
-   their search.  This document describes the output format of three
+   their search.  This document describes the output format of four
-   Passive DNS Systems which are in use today and which already share a
+   Passive DNS Systems ([DNSDB],[PDNSCERTAT], [PDNSCIRCL] and [PDNSCOF])
-   nearly identical output format.  As the format and the meaning of
+   which are in use today and which already share a nearly identical
 
 
 
@@ -114,11 +114,12 @@ Dulaunoy, et al.          Expires June 28, 2014                 [Page 2]
 Internet-Draft     Passive DNS - Common Output Format      December 2013
 
 
-   output fields from each Passive DNS need to be consistent, we propose
+   output format.  As the format and the meaning of output fields from
-   in this document a solution to commonly name each field along with
+   each Passive DNS need to be consistent, we propose in this document a
-   their corresponding interpretation.  The format format is following a
+   solution to commonly name each field along with their corresponding
-   simple key-value structure in JSON [RFC4627] format.  The benefit of
+   interpretation.  The format format is following a simple key-value
-   having a consistent Passive DNS output format is that multiple client
+   structure in JSON [RFC4627] format.  The benefit of having a
+   consistent Passive DNS output format is that multiple client
    implementations can query different servers without having to have a
    separate parser for each individual server. passivedns-client
    [PDNSCLIENT]currently implements multiple parsers due to a lack of
@@ -164,7 +165,6 @@ Internet-Draft     Passive DNS - Common Output Format      December 2013
 
 
 
-
 Dulaunoy, et al.          Expires June 28, 2014                 [Page 3]
 
 Internet-Draft     Passive DNS - Common Output Format      December 2013
@@ -250,7 +250,7 @@ Internet-Draft     Passive DNS - Common Output Format      December 2013
 
    Specifies the number of times this particular event denoted by the
    other type fields has been seen in the given time interval (between
-   time_last and time_first).  Decimal number.
+   time_last and time_first).
 
 3.3.2.  bailiwick
 
@@ -289,6 +289,13 @@ Internet-Draft     Passive DNS - Common Output Format      December 2013
    is expressed in seconds (decimal ascii) since 1st of January 1970
    (unix timestamp).  The time zone MUST be UTC.
 
+3.5.  Additional Fields Registry
+
+   In accordance with [RFC6648], designers of new passive DNS
+   applications that would need additional fields can request and
+   register new field name at https://github.com/adulau/pdns-qof/wiki/
+   Additional-Fields.
+
 4.  Acknowledgements
 
    Thanks to the Passive DNS developers who contributed to the document.
@@ -323,13 +330,6 @@ Internet-Draft     Passive DNS - Common Output Format      December 2013
    [RFC3912]  Daigle, L., "WHOIS Protocol Specification", RFC 3912,
               September 2004.
 
-   [RFC4627]  Crockford, D., "The application/json Media Type for
-              JavaScript Object Notation (JSON)", RFC 4627, July 2006.
-
-   [RFC5001]  Austein, R., "DNS Name Server Identifier (NSID) Option",
-              RFC 5001, August 2007.
-
-
 
 
 
@@ -338,6 +338,16 @@ Dulaunoy, et al.          Expires June 28, 2014                 [Page 6]
 Internet-Draft     Passive DNS - Common Output Format      December 2013
 
 
+   [RFC4627]  Crockford, D., "The application/json Media Type for
+              JavaScript Object Notation (JSON)", RFC 4627, July 2006.
+
+   [RFC5001]  Austein, R., "DNS Name Server Identifier (NSID) Option",
+              RFC 5001, August 2007.
+
+   [RFC6648]  Saint-Andre, P., Crocker, D., and M. Nottingham,
+              "Deprecating the "X-" Prefix and Similar Constructs in
+              Application Protocols", BCP 178, RFC 6648, June 2012.
+
 7.2.  References
 
    [BAILIWICK]
@@ -349,15 +359,41 @@ Internet-Draft     Passive DNS - Common Output Format      December 2013
               "Black ops 2008: It's the end of the cache as we know
               it.", 2008, <http://kurser.lobner.dk/dDist/DMK_BO2K8.pdf>.
 
+   [DNSDB]    "DNSDB API", 2013, <https://api.dnsdb.info/>.
+
+   [PDNSCERTAT]
+              "pDNS presentation at 4th Centr R&D workshop Frankfurt Jun
+              5th 2012", 2012, <http://www.centr.org/system/files/agenda
+              /attachment/rd4-papst-passive_dns.pdf>.
+
+   [PDNSCIRCL]
+              "CIRCL Passive DNS", 2012, <http://pdns.circl.lu/>.
+
    [PDNSCLIENT]
               "Queries 5 major Passive DNS databases: BFK, CERTEE,
               DNSParse, ISC, and VirusTotal.", 2013, <https://github.com
               /chrislee35/passivedns-client>.
 
+   [PDNSCOF]  "Passive DNS server interface using the common output
+              format", 2013, <https://github.com/adulau/pdns-qof-server/
+              >.
+
    [REST]     "Representational State Transfer (REST)", 2000,
               <http://www.ics.uci.edu/~fielding/pubs/dissertation/
               rest_arch_style.htm>.
 
+   [WEINERPDNS]
+              "Passive DNS Replication", 2005, <http://www.enyo.de/fw/
+              software/dnslogger/first2005-paper.pdf>.
+
+
+
+
+Dulaunoy, et al.          Expires June 28, 2014                 [Page 7]
+
+Internet-Draft     Passive DNS - Common Output Format      December 2013
+
+
 7.3.  Informative References
 
    [I-D.narten-iana-considerations-rfc2434bis]
@@ -366,34 +402,12 @@ Internet-Draft     Passive DNS - Common Output Format      December 2013
               considerations-rfc2434bis-09 (work in progress), March
               2008.
 
-   [RFC2629]  Rose, M., "Writing I-Ds and RFCs using XML", RFC 2629,
-              June 1999.
-
    [RFC3552]  Rescorla, E. and B. Korver, "Guidelines for Writing RFC
               Text on Security Considerations", BCP 72, RFC 3552, July
               2003.
 
-   [RFC3912]  Daigle, L., "WHOIS Protocol Specification", RFC 3912,
-              September 2004.
-
-Appendix A.  Appendix
-
 Authors' Addresses
 
-
-
-
-
-
-
-
-
-
-Dulaunoy, et al.          Expires June 28, 2014                 [Page 7]
-
-Internet-Draft     Passive DNS - Common Output Format      December 2013
-
-
    Alexandre Dulaunoy
    CIRCL
    41, avenue de la gare
@@ -423,6 +437,19 @@ Internet-Draft     Passive DNS - Common Output Format      December 2013
    URI:   /
 
 
+
+
+
+
+
+
+
+
+Dulaunoy, et al.          Expires June 28, 2014                 [Page 8]
+
+Internet-Draft     Passive DNS - Common Output Format      December 2013
+
+
    Henry Stern
    Cisco
    1741 Brunswick Street, Suite 500
@@ -445,4 +472,33 @@ Internet-Draft     Passive DNS - Common Output Format      December 2013
 
 
 
-Dulaunoy, et al.          Expires June 28, 2014                 [Page 8]
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Dulaunoy, et al.          Expires June 28, 2014                 [Page 9]

i-d/pdns-qof.xml

@@ -15,6 +15,8 @@
 <!ENTITY RFC5001 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.5001.xml">
 <!ENTITY RFC3597 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.3597.xml">
 <!ENTITY RFC3912 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.3912.xml">
+<!ENTITY RFC6648 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.6648.xml">
+
 <!ENTITY I-D.narten-iana-considerations-rfc2434bis SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.narten-iana-considerations-rfc2434bis.xml">
 ]>
 <?xml-stylesheet type='text/xsl' href='rfc2629.xslt' ?>
@@ -42,7 +44,7 @@
 <?rfc subcompact="no" ?>
 <!-- keep one blank line between list items -->
 <!-- end of list of popular I-D processing instructions -->
-<rfc category="info" docName="draft-ietf-dulaunoy-kaplan-pdns-cof-01" ipr="trust200902">
+<rfc category="info" docName="draft-ietf-dulaunoy-passive-dns-cof-00" ipr="trust200902">
   <!-- category values: std, bcp, info, exp, and historic
      ipr values: full3667, noModification3667, noDerivatives3667
      you can add the attributes updates="NNNN" and obsoletes="NNNN" 
@@ -138,7 +140,7 @@
     <section title="Introduction">
      <t>Passive DNS is a technique described by Florian Weimer in 2005 in <xref target="WEINERPDNS">Passive DNS replication, F Weimer - 17th Annual FIRST Conference on Computer Security</xref>. Since then multiple Passive DNS implementations evolved over time. Users of these Passive DNS servers query a server (often via <xref target="RFC3912">WHOIS</xref> or HTTP <xref target="REST">REST</xref>), parse the results and process them in other applications.</t>
      <t>
-    There are multiple implementation of Passive DNS software. Users of passive DNS query each implementation and aggregate the results for their search. This document describes the output format of three Passive DNS Systems (<xref target="DNSDB"/>,<xref target="PDNSCERTAT"/> and <xref target="PDNSCIRCL"/>) which are in use today and which already share a nearly identical output format.
+    There are multiple implementation of Passive DNS software. Users of passive DNS query each implementation and aggregate the results for their search. This document describes the output format of four Passive DNS Systems (<xref target="DNSDB"/>,<xref target="PDNSCERTAT"/>, <xref target="PDNSCIRCL"/> and <xref target="PDNSCOF"/>) which are in use today and which already share a nearly identical output format.
 
 	As the format and the meaning of output fields from each Passive DNS need to be consistent, we propose in this document a solution to commonly name each field along with their corresponding interpretation. The format is following a simple key-value structure in <xref target="RFC4627">JSON</xref> format.
 The benefit of having a consistent Passive DNS output format is that multiple client implementations can query different servers without having to have a separate parser for each
@@ -221,8 +223,11 @@ The document does not describe the protocol (e.g. <xref target="RFC3912">WHOIS</
             <section title="zone_time_last">
             <t>This field returns the last time that the unique tuple (rrname, rrtype, rdata) record has been seen via zone file import. The date is expressed in seconds (decimal ascii) since 1st of January 1970 (unix timestamp). The time zone MUST be UTC.</t>
             </section>
-		</section>
+              </section>
-	</section>
+        <section title="Additional Fields Registry">
+           <t>In accordance with <xref target="RFC6648"/>, designers of new passive DNS applications that would need additional fields can request and register new field name at https://github.com/adulau/pdns-qof/wiki/Additional-Fields.</t>
+        </section>
+    </section>
 
 
     <!-- This PI places the pagebreak correctly (before the section title) in the text output. -->
@@ -273,6 +278,7 @@ The document does not describe the protocol (e.g. <xref target="RFC3912">WHOIS</
       &RFC4627;
       &RFC5001;
       &RFC3597;
+      &RFC6648;
     </references>
     <references>
          <reference anchor="WEINERPDNS" target="http://www.enyo.de/fw/software/dnslogger/first2005-paper.pdf">
@@ -331,7 +337,13 @@ The document does not describe the protocol (e.g. <xref target="RFC3912">WHOIS</
           <date year="2012"/>
           </front>
         </reference>
-
+        <reference anchor="PDNSCOF" target="https://github.com/adulau/pdns-qof-server/">
+          <front>
+          <title>Passive DNS server interface using the common output format</title>
+          <author fullname="Alexandre Dulaunoy"/>
+          <date year="2013"/>
+          </front>
+        </reference>
     </references>
 
     <references title="Informative References">