Subject: [provreg] Proposal: A standard EPP OT&E test suite for each object type and extension type

From: Keith Gaughan <[email-masked]>
Date: Thu, 16 Jun 2011 17:25:41 +0100

Hello, all.

This is the first in a series of suggestions from a registrar's point of view
improvements that can be made to and around EPP to make the life of registrars
easier. Consider them food for thought if nothing else.

A standard EPP test suite from OT&E would, I think, serve two important
purposes. Firstly, it would be an immense help to registrar who are
developing their domain management systems for the first time as not all of
us use Net::DRI for Perl or EPP-RTK for Java and C++. Ours, for instance, is
written in a combination of Python and PHP. Secondly, it would mean that
registrars would only need to run through the test suite *once*, which would
greatly reduce the management overhead for both registrars and registries
during accreditation. A central registry, likely maintained by ICANN, listing
whether a registrar has successfully completed a particular part of the test
suite, would also be useful.

If ICANN does, in fact, sanction the creation of a large number of new gTLDs,
this could be a big deal.

-- 
Keith Gaughan, Software Developer
PGP/GPG key ID: 3E896381
Blacknight Internet Solutions Ltd. <http://blacknight.com/>
12A Barrowside Business Park, Carlow, Ireland
Registered in Ireland, Company No.: 370845

---

From: Klaus Malorny <[email-masked]>
Date: Fri, 17 Jun 2011 08:50:22 +0200

On 16/06/11 18:25, Keith Gaughan wrote:
> Hello, all.
>
> [...] Secondly, it would mean that

Hi,

as a side note, I'd like to express that accreditation tests that require 
registrars to perform certain operations on a test system in a certain order 
with certain parameters is IMHO completely useless and a waste of (human) 
resources. As soon as a registrar starts to write a custom script to perform the 
test instead of simply trying to let his registration system interact with the 
registry's system, the proof loses its value. And to my experience, this happens 
in most of the cases. For this reason, we as a registry operator are trying to 
convince the TLD sponsor not to demand the execution of a technical 
accreditation test by the registrar at all.

Regards,

Klaus

---

From: InterNetX - Volker Janzen <[email-masked]>
Date: Fri, 17 Jun 2011 09:11:53 +0200

Hi all,

Am 17.06.2011 08:50, schrieb Klaus Malorny:
> as a side note, I'd like to express that accreditation tests that
> require registrars to perform certain operations on a test system in a
> certain order with certain parameters is IMHO completely useless and a
> waste of (human) resources. As soon as a registrar starts to write a
> custom script to perform the test instead of simply trying to let his
> registration system interact with the registry's system, the proof loses
> its value.

I agree with this. I know many registries that have a test catalogue
which forces registrars to do such scripting, because the test cases are
far away from production use. In this case, 0% to 10% of the productive
EPP implementation is tested.

In my work I had rare circumstances where a registry instructed us to
run our own custom tests. In that cases we run our own test-suite which
covers > 90% of EPP production usage. We were very happy with this and
it was no problem to send a few extra commands, that were not part of
the test to satisfy the registry that we've everything up and running.

Volker Janzen
Team Entwicklung

-- 
InterNetX GmbH
Maximilianstr. 6
93047 Regensburg
Germany

Tel: +49 941 59559-0
Fax: +49 941 59579-050

www.internetx.com
www.facebook.com/InterNetX
www.twitter.com/InterNetX

Geschäftsführer/CEO: Thomas Mörz
Amtsgericht Regensburg, HRB 7142

GPG-Key: 0x186C5F77
GPG-Fingerprint: 392E 8730 FE23 DCE8 8878 8524 5361 BCCC 186C 5F77

---

From: Wil Tan <[email-masked]>
Date: Fri, 17 Jun 2011 18:09:10 +1000

On Fri, Jun 17, 2011 at 4:50 PM, Klaus Malorny <[email-masked]>wrote:

> resources. As soon as a registrar starts to write a custom script to perform
> the test instead of simply trying to let his registration system interact
> with the registry's system, the proof loses its value. And to my experience,
> this happens in most of the cases. For this reason, we as a registry
> operator are trying to convince the TLD sponsor not to demand the execution
> of a technical accreditation test by the registrar at all.
>
>
Concur. We see no value in it and don't require it on our registry system
either.

-- 
Wil Tan
CTO
Cloud Registry <http://www.cloudregistry.net>

---

From: Jim Reid <[email-masked]>
Date: Fri, 17 Jun 2011 10:27:33 +0100

On 16 Jun 2011, at 17:25, Keith Gaughan wrote:

> purposes.

IMO, it would have a much more important benefit than the ones you  
list. It would encourage registries to stick to the functionality of  
that test suite and not stray into the world of registry-specific  
quirks and EPP hooks. That would be a Good Thing. OTOH, this could be  
difficult for some registries to do, particularly ccTLDs, because  
local policy and/or legislation requires registry-specific quirks and  
EPP hooks.

> Secondly, it would mean that registrars would only need to run  
> through the test suite *once*, which would greatly reduce the  
> management overhead for both registrars and registries during  
> accreditation.

In theory yes. In reality, perhaps not. For instance, the contact  
object schema for .tel had to be extended to accommodate flags for an  
opt-out from whois. This was specific to the TLD. That sort of tweak  
probably wouldn't be in this standard test suite. Those kinds of  
extensions will sometimes be unavoidable, even in the usual one size  
fits all model of the gTLD world. The E of EPP is a big hint here. :-)

FWIW some registrars initially failed OT&E accreditation for .tel even  
though they'd done that for other TLDs run by the same registry  
provider. I don't remember (and today I don't care) what caused those  
failures. I do recall it was the registrars who said ".tel is just  
like all the other Neustar-operated gTLDs" that tended to have  
difficulties. I don't know if they'd used the supplied toolkits or  
dusted down their own (Neustar-specific?) EPP clients that had been  
sitting on a shelf somewhere. Maybe they just didn't read the  
documentation.

---

From: Ulrich Wisser <[email-masked]>
Date: Fri, 17 Jun 2011 11:40:02 +0200

Hi,

at .SE we require such a test. We do provide test data and require
registrars to perform some (as we like to think) real world tasks. We do not
care about issued EPP commands but rather the final state of the objects.

We did not get a lot of feedback (none so far) on this procedure from
registrars.
Please take your chances and mail some feedback on of off list.

Thanks in advance

Ulrich

2011/6/17 InterNetX - Volker Janzen <[email-masked]>

> _______________________________________________
> provreg mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/provreg
>
>

---

From: Patrik Fältström <[email-masked]>
Date: Fri, 17 Jun 2011 17:44:40 +0800

> We did not get a lot of feedback (none so far) on this procedure from

Good process, largest problem for registrars is (I claim) that different registries have so different epp and model.

Take "how to do a transfer" for example. Or even "register a domain name". Or requirements on what codepoints can be used for registrations.

You registries, can you list what commands are needed for a transfer for a domain from one registrar to another?

Have you been thinking of whether what you require is same/different from others *before* you decided on how transfers are made in interactions with you?

I do understand if there are say 2-5 different business models etc, but one per registry, that is (to be honest, but sorry for the language -- I am exaggerating a bit of course) "just silly". I do not see that being needed or good for domain name registrations in the world.

   Patrik

---

From: Jim Reid <[email-masked]>
Date: Fri, 17 Jun 2011 11:03:34 +0100

On 17 Jun 2011, at 10:44, Patrik Fältström wrote:

> I do understand if there are say 2-5 different business models etc,  
> but one per registry, that is (to be honest, but sorry for the  
> language -- I am exaggerating a bit of course) "just silly". I do  
> not see that being needed or good for domain name registrations in  
> the world.

True.

However with 200+ countries in the world, that pretty much means 200+  
different business models because there are 200+ different registry  
policies or national laws.... :-(

It might be better to approach this from a different direction. How  
about defining a standard set of registry transactions -- create/ 
delete/modify objects, renew and transfer a domain name, etc -- and  
writing this up as a BCP? Once that's done, the BCP could be encoded  
in a standard test suite. In other words, document what it is that's  
to be tested before developing a test suite. Some tests might be  
optional (for instance IDN and DNSSEC might not be deployed in places)  
while others are mandatory.

---

From: Patrik Fältström <[email-masked]>
Date: Fri, 17 Jun 2011 18:08:59 +0800

On 17 jun 2011, at 18.03, Jim Reid wrote:

> However with 200+ countries in the world, that pretty much means 200+ different business models because there are 200+ different registry policies or national laws.... :-(

Well, not really.

Let me take an example:

When you do transfer of a domain, what happens with the host and contact objects that are bound to the domain? What notifications are sent, and what actions have to be taken?

I think, even though we have 200+ different business models, I claim those can be implemented with only say 3-5 different ways of doing transfer.

> It might be better to approach this from a different direction. How about defining a standard set of registry transactions -- create/delete/modify objects, renew and transfer a domain name, etc -- and writing this up as a BCP? Once that's done, the BCP could be encoded in a standard test suite. In other words, document what it is that's to be tested before developing a test suite. Some tests might be optional (for instance IDN and DNSSEC might not be deployed in places) while others are mandatory.

I fully support this. And is implicitly what I am asking for. That registries try to, before they invent their own epp architecture, look carefully at if they can not reuse what someone else is doing.

I do not see that happening today. Not as much as I as an implementor in the registrar side would like to see.

   Patrik

---

From: Keith Gaughan <[email-masked]>
Date: Fri, 17 Jun 2011 11:22:21 +0100

On 17/06/11 11:03, Jim Reid wrote:

>> I do understand if there are say 2-5 different business models etc, but one
>> per registry, that is (to be honest, but sorry for the language -- I am
>> exaggerating a bit of course) "just silly". I do not see that being needed
>> or good for domain name registrations in the world.
> 
> True.
> 
> different business models because there are 200+ different registry policies
> or national laws.... :-(
> 
> It might be better to approach this from a different direction. How about
> defining a standard set of registry transactions -- create/delete/modify
> objects, renew and transfer a domain name, etc -- and writing this up as a
> BCP? Once that's done, the BCP could be encoded in a standard test suite. In
> other words, document what it is that's to be tested before developing a test
> suite. Some tests might be optional (for instance IDN and DNSSEC might not be
> deployed in places) while others are mandatory.

That's not a million miles from what I was originally thinking, and personally
I'm very much behind this idea. It may help discourage
unnecessarily heterodox design decisions by future registry operators.

K.

---

From: Keith Gaughan <[email-masked]>
Date: Fri, 17 Jun 2011 11:32:09 +0100

On 17/06/11 10:27, Jim Reid wrote:

> IMO, it would have a much more important benefit than the ones you list. It
> would encourage registries to stick to the functionality of that test suite
> and not stray into the world of registry-specific quirks and EPP hooks. That
> would be a Good Thing. OTOH, this could be difficult for some registries to
> do, particularly ccTLDs, because local policy and/or legislation requires
> registry-specific quirks and EPP hooks.

Excellent point.

>> Secondly, it would mean that registrars would only need to run through the
>> test suite *once*, which would greatly reduce the management overhead for
>> both registrars and registries during accreditation.
> 
> In theory yes. In reality, perhaps not. For instance, the contact object
> schema for .tel had to be extended to accommodate flags for an opt-out from
> whois.

Key there is that they used NeuStar's catch-all extension for arbitrary
key-value pairs. Frankly, when that thing gets involved, *all* bets are off.

> This was specific to the TLD. That sort of tweak probably wouldn't be
> in this standard test suite. Those kinds of extensions will sometimes be
> unavoidable, even in the usual one size fits all model of the gTLD world. The
> E of EPP is a big hint here. :-)

Yep, and it happened again with the .tel landrush to a certain degree, but the
underlying semantics of the EPP envelope and the domain mapping themselves
remained the same.

Nothing's perfect. :-)

K.

---

From: Klaus Malorny <[email-masked]>
Date: Fri, 17 Jun 2011 12:36:59 +0200

On 17/06/11 11:27, Jim Reid wrote:
> In theory yes. In reality, perhaps not. For instance, the contact object schema
> for .tel had to be extended to accommodate flags for an opt-out from whois. This
> was specific to the TLD. That sort of tweak probably wouldn't be in this
> standard test suite. Those kinds of extensions will sometimes be unavoidable,
> even in the usual one size fits all model of the gTLD world. The E of EPP is a
> big hint here. :-)
>

Hi Jim,

sorry, but this was the wrong example for extending the EPP. I could give 
details, but I don't want to start a general bashing here. :-)

Regards,

Klaus