CoRE Working Group P. van der Stok Internet-Draft consultant Intended status: Informational K. Hartke Expires: August 31, 2017 Universitaet Bremen TZI February 27, 2017 The 'Pending' Response Code for the Constrained Application Protocol (CoAP) draft-hartke-core-pending-00 Abstract This document proposes a new CoAP response code, 2.06 Pending. A CoAP server can use this response code to signal that it has accepted the request but has not yet started processing it or that processing the request will take longer than a client is typically willing to wait for a response. A 2.06 response can include status information and indicate a location where the result will become available. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at http://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on August 31, 2017. Copyright Notice Copyright (c) 2017 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must van der Stok & Hartke Expires August 31, 2017 [Page 1] Internet-Draft The 'Pending' Response Code for CoAP February 2017 include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 1.1. Terminology . . . . . . . . . . . . . . . . . . . . . . . 3 2. 2.06 Pending . . . . . . . . . . . . . . . . . . . . . . . . 3 2.1. Observing Resources . . . . . . . . . . . . . . . . . . . 4 3. Security Considerations . . . . . . . . . . . . . . . . . . . 4 4. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 5 5. References . . . . . . . . . . . . . . . . . . . . . . . . . 5 5.1. Normative References . . . . . . . . . . . . . . . . . . 5 5.2. Informative References . . . . . . . . . . . . . . . . . 5 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 6 1. Introduction The Constrained Application Protocol (CoAP) [RFC7252] is a request/ response protocol not unlike HTTP. CoAP defines no upper bound for the time between a request and the resulting response. E.g., in CoAP over UDP, a server is expected to return an empty Acknowledgement to the client if it cannot provide a response right away, but there is no limit on when the server should return the Separate Response. In particular in the case of requests with long processing times, a CoAP client faces the problem that it cannot easily determine how long it should wait for the response and whether the CoAP server is even still processing the request. Long processing times occur, for example, when requests need manual intervention to authorize their processing, or when they perform a long sequence of remote actions. An example is provided by the "possibly long" authorization request specified in EST-coaps [I-D.vanderstok-ace-coap-est]. This document proposes a new CoAP response code, 2.06 Pending. The semantics of this response code are modelled after the HTTP [RFC7231] 202 (Accepted) status code: The 202 (Accepted) status code indicates that the request has been accepted for processing, but the processing has not been completed. The request might or might not eventually be acted upon, as it might be disallowed when processing actually takes place. [...] The representation sent with this response ought to describe the request's current status and point to (or embed) a status monitor that can provide the user with an estimate of when the request will be fulfilled. van der Stok & Hartke Expires August 31, 2017 [Page 2] Internet-Draft The 'Pending' Response Code for CoAP February 2017 The 2.06 (Pending) response code is not meant for overload cases, which are better handled by the 5.03 (Service Unavailable) response code. 1.1. Terminology Readers are expected to be familiar with the terms and concepts described in [RFC7252] and [RFC7641]. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. 2. 2.06 Pending A 2.06 (Pending) response in reply to a GET request indicates that the target resource exists but no representation of the resource is available yet. The Max-Age Option indicates after what time a client should retry its GET request to retrieve the representation. The client MAY observe the resource (see Section 2.1) to be notified when the representation becomes available. A 2.06 (Pending) response in reply to a POST request indicates that the result of processing the request is not available yet, for example, because the server needs more time to process the request than a client is typically willing to wait for a response. The server MAY specify a location using the Location-* options where the result will become available. If the server does not specify a location, the result will become available at the target resource of the POST request. To receive the result, the client MAY poll or observe the resource at the specified location using a GET request. The Max-Age Option indicates how long the client should wait before making the GET request. A 2.06 (Pending) response MAY contain a payload that represents the progress of processing the original request or any other status information. The content format of this representation is specified by the Content-Format Option. A 2.06 (Pending) response is cacheable, but cannot be validated. If it contains Location-* options, it invalidates any cached response for the resource at the specified location; otherwise, it invalidates any cached response for the target resource of the request. As a consequence of being cacheable, a 2.06 (Pending) response in reply to a POST request makes the POST method temporarily idempotent: until Max-Age expires, any POST request with the same cache-key -- be van der Stok & Hartke Expires August 31, 2017 [Page 3] Internet-Draft The 'Pending' Response Code for CoAP February 2017 it from the same client or any another client -- can yield the same 2.06 (Pending) response. (This is the same behavior as for 4.xx and 5.xx error responses in reply to POST requests.) 2.1. Observing Resources When a client registers to observe [RFC7641] a resource for which no representation is available yet, the server MAY send one or more 2.06 (Pending) notifications before sending the first 2.05 (Content) or 2.03 (Valid) notification. The possible resulting sequence of notifications is shown in Figure 1. __________ __________ __________ | | | | | | ---->| 2.06 |---->| 2.05 / |---->| 4.xx / | | Pending | | 2.03 | | 5.xx | |__________| |__________| |__________| ^ \ \ ^ \ ^ \__/ \ \___/ / \_______________________/ Figure 1: Sequence of Notifications Unless the server is not willing to add the client to the list of observers, each 2.06 (Pending) notification MUST include an Observe Option with a sequence number as specified in [RFC7641]. Otherwise, the registration request falls back to a normal GET request. 3. Security Considerations This section analyses the possible threats related to 2.06 (Pending) responses. It is meant to inform protocol and application developers about the security limitations of the response code as described in this document. A 2.06 (Pending) response is subject to the same general security considerations as all CoAP responses as described in Section 11 of [RFC7252]. Specifically, the security considerations for the response code are closest to those of the Observe Option as stated in Section 7 of [RFC7641], because the server stores additional state over an extended period. 2.06 (Pending) responses are secured following the recommendations for the existing CoAP response codes as specified in Section 9 of [RFC7252]. When additional security techniques are standardized for CoAP (e.g., based on object security), these are then also available for securing the responses. van der Stok & Hartke Expires August 31, 2017 [Page 4] Internet-Draft The 'Pending' Response Code for CoAP February 2017 4. IANA Considerations This document adds the 2.06 (Pending) response code to the "CoAP Response Codes" registry. +------+-------------+-----------+ | Code | Description | Reference | +------+-------------+-----------+ | 2.06 | Pending | [RFCXXXX] | +------+-------------+-----------+ Table 1: New CoAP Response Codes 5. References 5.1. Normative References [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, . [RFC7252] Shelby, Z., Hartke, K., and C. Bormann, "The Constrained Application Protocol (CoAP)", RFC 7252, DOI 10.17487/RFC7252, June 2014, . [RFC7641] Hartke, K., "Observing Resources in the Constrained Application Protocol (CoAP)", RFC 7641, DOI 10.17487/RFC7641, September 2015, . 5.2. Informative References [I-D.vanderstok-ace-coap-est] Kumar, S. and P. Stok, "EST based on DTLS secured CoAP (EST-coaps)", draft-vanderstok-ace-coap-est-00 (work in progress), December 2016. [RFC7231] Fielding, R., Ed. and J. Reschke, Ed., "Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content", RFC 7231, DOI 10.17487/RFC7231, June 2014, . van der Stok & Hartke Expires August 31, 2017 [Page 5] Internet-Draft The 'Pending' Response Code for CoAP February 2017 Authors' Addresses Peter van der Stok consultant Phone: +31-492474673 (Netherlands), +33-966015248 (France) Email: consultancy@vanderstok.org URI: www.vanderstok.org Klaus Hartke Universitaet Bremen TZI Postfach 330440 Bremen D-28359 Germany Phone: +49-421-218-63905 Email: hartke@tzi.org van der Stok & Hartke Expires August 31, 2017 [Page 6]