va: Validate Persistent DCV TXT Record parameter tags per RFC 8659
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 78/100
Research direction
Start in va/dns_persist.go at parseDNSPersistRecord and read RFC 8659 Section 4.2 for the tag grammar. Compare the analogous CAA validation path and pull request 8977, then run the relevant va package tests. Done means Persistent DCV records with disallowed parameter-tag characters are rejected according to the RFC.
Written by the indexing model from the issue text.
Description
parseDNSPersistRecord in va/dns_persist.go, which validates the Persistent DCV TXT Record for BR Section 3.2.2.4.22 (DNS TXT Record with Persistent Value), does not validate the parameter tag against the RFC 8659 tag grammar. It accepts a tag containing characters the grammar disallows (for example foo_bar) and ignores it as an unknown parameter.
BR Section 3.2.2.4.22 requires the record to conform to that syntax:
- The RDATA value MUST conform to the
issue-valuesyntax as defined in RFC 8659, Section 4.2; and
So accepting a tag that does not match the RFC 8659 tag production could be a violation.
This is the same class of violation as the CAA path, where parseCAARecord accepted invalid (empty) parameter tags. See https://github.com/letsencrypt/boulder/pull/8977 for more details.
- Dominant language
- Go
- Stars
- 5.8k
- Forks
- 649
- Avg merge
- 3d 23h
- Merged PRs (30d)
- 24
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from letsencrypt/boulder
-
Difficulty 5/5 Over a week Newbie friendliness 30/100
letsencrypt/boulder#9022 ·
-
letsencrypt/boulder#9021 · 1 assignee ·
-
Difficulty 5/5 Over a week Newbie friendliness 39/100
letsencrypt/boulder#9020 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
letsencrypt/boulder#9018 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 45/100
letsencrypt/boulder#9015 ·
All issues in letsencrypt/boulder
Similar issues
-
Difficulty 1/5 Under an hour Newbie friendliness 84/100
-
enhancement needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
kind/cleanup
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
kubernetes-sigs/kueue#15947 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
sympozium-ai/sympozium#627 ·
-
priority: p3
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
googleapis/librarian#7636 ·