Skip to content

Commit 1e6699d

Browse files
Roland Bracewell Shoemakerjsha
Roland Bracewell Shoemaker
authored and
jsha
committed
Remove hyphens from ACME-CAA parameters (letsencrypt#3772)
The hyphens were incompatible with RFC 6844 (but not RFC 6844bis), and broke some CAA-processing software in practice. Hugo revised the ACME-CAA draft (https://datatracker.ietf.org/doc/html/draft-ietf-acme-caa-05) to remove the hyphens.
1 parent 3f348f1 commit 1e6699d

File tree

5 files changed

+33
-33
lines changed

5 files changed

+33
-33
lines changed

‎features/features.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,9 +39,9 @@ const (
3939
EnforceOverlappingWildcards
4040
// Set orders to status "ready" when they are awaiting finalization
4141
OrderReadyStatus
42-
// Check CAA and respect validation-methods parameter.
42+
// Check CAA and respect validationmethods parameter.
4343
CAAValidationMethods
44-
// Check CAA and respect account-uri parameter.
44+
// Check CAA and respect accounturi parameter.
4545
CAAAccountURI
4646
)
4747

‎test/challtestsrv/dnsone.go‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -102,9 +102,9 @@ func (s *ChallSrv) dnsHandler(w dns.ResponseWriter, r *dns.Msg) {
102102
value = "sad-hacker-ca.invalid"
103103
case "good-caa-reserved.com.":
104104
value = "happy-hacker-ca.invalid"
105-
case "account-uri.good-caa-reserved.com.":
105+
case "accounturi.good-caa-reserved.com.":
106106
uri := os.Getenv("ACCOUNT_URI")
107-
value = fmt.Sprintf("happy-hacker-ca.invalid; account-uri=%s", uri)
107+
value = fmt.Sprintf("happy-hacker-ca.invalid; accounturi=%s", uri)
108108
case "recheck.good-caa-reserved.com.":
109109
// Allow issuance when we're running in the past
110110
// (under FAKECLOCK), otherwise deny issuance.
@@ -114,11 +114,11 @@ func (s *ChallSrv) dnsHandler(w dns.ResponseWriter, r *dns.Msg) {
114114
value = "sad-hacker-ca.invalid"
115115
}
116116
case "dns-01-only.good-caa-reserved.com.":
117-
value = "happy-hacker-ca.invalid; validation-methods=dns-01"
117+
value = "happy-hacker-ca.invalid; validationmethods=dns-01"
118118
case "http-01-only.good-caa-reserved.com.":
119-
value = "happy-hacker-ca.invalid; validation-methods=http-01"
119+
value = "happy-hacker-ca.invalid; validationmethods=http-01"
120120
case "dns-01-or-http-01.good-caa-reserved.com.":
121-
value = "happy-hacker-ca.invalid; validation-methods=dns-01,http-01"
121+
value = "happy-hacker-ca.invalid; validationmethods=dns-01,http-01"
122122
default:
123123
addCAARecord = false
124124
}

‎test/integration-test.py‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -309,7 +309,7 @@ def test_revoke_by_account():
309309

310310
def test_caa():
311311
"""Request issuance for two CAA domains, one where we are permitted and one where we are not.
312-
Two further sub-domains have restricted validation-methods.
312+
Two further sub-domains have restricted validationmethods.
313313
"""
314314
if len(caa_authzs) == 0:
315315
raise Exception("CAA authzs not prepared for test_caa")
@@ -346,8 +346,8 @@ def test_caa():
346346
auth_and_issue(["dns-01-or-http-01.good-caa-reserved.com", "http-01-only.good-caa-reserved.com"], chall_type="http-01")
347347

348348
# CAA should fail with an arbitrary account, but succeed with the caa_client.
349-
chisel.expect_problem("urn:acme:error:caa", lambda: auth_and_issue(["account-uri.good-caa-reserved.com"]))
350-
auth_and_issue(["account-uri.good-caa-reserved.com"], client=caa_client)
349+
chisel.expect_problem("urn:acme:error:caa", lambda: auth_and_issue(["accounturi.good-caa-reserved.com"]))
350+
auth_and_issue(["accounturi.good-caa-reserved.com"], client=caa_client)
351351

352352
def test_account_update():
353353
"""

‎va/caa.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -269,10 +269,10 @@ func (va *ValidationAuthorityImpl) validateCAASet(caaSet *CAASet, wildcard bool,
269269
}
270270

271271
if features.Enabled(features.CAAAccountURI) {
272-
// Check the account-uri CAA parameter as defined
272+
// Check the accounturi CAA parameter as defined
273273
// in section 3 of the draft CAA ACME RFC:
274274
// https://tools.ietf.org/html/draft-ietf-acme-caa-04
275-
caaAccountURI, ok := caaParameters["account-uri"]
275+
caaAccountURI, ok := caaParameters["accounturi"]
276276
if ok {
277277
if params.accountURIID == nil {
278278
continue
@@ -283,10 +283,10 @@ func (va *ValidationAuthorityImpl) validateCAASet(caaSet *CAASet, wildcard bool,
283283
}
284284
}
285285
if features.Enabled(features.CAAValidationMethods) {
286-
// Check the validation-methods CAA parameter as defined
286+
// Check the validationmethods CAA parameter as defined
287287
// in section 4 of the draft CAA ACME RFC:
288288
// https://tools.ietf.org/html/draft-ietf-acme-caa-04
289-
caaMethods, ok := caaParameters["validation-methods"]
289+
caaMethods, ok := caaParameters["validationmethods"]
290290
if ok {
291291
if params.validationMethod == nil {
292292
continue

‎va/caa_test.go‎

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -93,31 +93,31 @@ func (mock caaMockDNS) LookupCAA(_ context.Context, domain string) ([]*dns.CAA,
9393
results = append(results, &record)
9494
case "present-dns-only.com":
9595
record.Tag = "issue"
96-
record.Value = "letsencrypt.org; validation-methods=dns-01"
96+
record.Value = "letsencrypt.org; validationmethods=dns-01"
9797
results = append(results, &record)
9898
case "present-http-only.com":
9999
record.Tag = "issue"
100-
record.Value = "letsencrypt.org; validation-methods=http-01"
100+
record.Value = "letsencrypt.org; validationmethods=http-01"
101101
results = append(results, &record)
102102
case "present-http-or-dns.com":
103103
record.Tag = "issue"
104-
record.Value = "letsencrypt.org; validation-methods=http-01,dns-01"
104+
record.Value = "letsencrypt.org; validationmethods=http-01,dns-01"
105105
results = append(results, &record)
106-
case "present-correct-account-uri.com":
106+
case "present-correct-accounturi.com":
107107
record.Tag = "issue"
108-
record.Value = "letsencrypt.org; account-uri=https://letsencrypt.org/acct/reg/123"
108+
record.Value = "letsencrypt.org; accounturi=https://letsencrypt.org/acct/reg/123"
109109
results = append(results, &record)
110-
case "present-incorrect-account-uri.com":
110+
case "present-incorrect-accounturi.com":
111111
record.Tag = "issue"
112-
record.Value = "letsencrypt.org; account-uri=https://letsencrypt.org/acct/reg/321"
112+
record.Value = "letsencrypt.org; accounturi=https://letsencrypt.org/acct/reg/321"
113113
results = append(results, &record)
114-
case "present-multiple-account-uri.com":
114+
case "present-multiple-accounturi.com":
115115
record.Tag = "issue"
116-
record.Value = "letsencrypt.org; account-uri=https://letsencrypt.org/acct/reg/321"
116+
record.Value = "letsencrypt.org; accounturi=https://letsencrypt.org/acct/reg/321"
117117
results = append(results, &record)
118118
secondRecord := record
119119
secondRecord.Tag = "issue"
120-
secondRecord.Value = "letsencrypt.org; account-uri=https://letsencrypt.org/acct/reg/123"
120+
secondRecord.Value = "letsencrypt.org; accounturi=https://letsencrypt.org/acct/reg/123"
121121
results = append(results, &secondRecord)
122122
case "unsatisfiable.com":
123123
record.Tag = "issue"
@@ -286,20 +286,20 @@ func TestCAAChecking(t *testing.T) {
286286
Valid: true,
287287
},
288288
{
289-
Name: "Good (restricts to account-uri, tested with correct account)",
290-
Domain: "present-correct-account-uri.com",
289+
Name: "Good (restricts to accounturi, tested with correct account)",
290+
Domain: "present-correct-accounturi.com",
291291
Present: true,
292292
Valid: true,
293293
},
294294
{
295-
Name: "Bad (restricts to account-uri, tested with incorrect account)",
296-
Domain: "present-incorrect-account-uri.com",
295+
Name: "Bad (restricts to accounturi, tested with incorrect account)",
296+
Domain: "present-incorrect-accounturi.com",
297297
Present: true,
298298
Valid: false,
299299
},
300300
{
301-
Name: "Good (restricts to multiple account-uri, tested with a correct account)",
302-
Domain: "present-multiple-account-uri.com",
301+
Name: "Good (restricts to multiple accounturi, tested with a correct account)",
302+
Domain: "present-multiple-accounturi.com",
303303
Present: true,
304304
Valid: true,
305305
},
@@ -382,10 +382,10 @@ func TestCAAChecking(t *testing.T) {
382382
test.Assert(t, present, "Present should be true")
383383
test.Assert(t, valid, "Valid should be true")
384384

385-
// present-incorrect-account-uri.com should now be also be valid
386-
ident = core.AcmeIdentifier{Type: "dns", Value: "present-incorrect-account-uri.com"}
385+
// present-incorrect-accounturi.com should now be also be valid
386+
ident = core.AcmeIdentifier{Type: "dns", Value: "present-incorrect-accounturi.com"}
387387
present, valid, _, err = va.checkCAARecords(ctx, ident, params)
388-
test.AssertNotError(t, err, "present-incorrect-account-uri.com")
388+
test.AssertNotError(t, err, "present-incorrect-accounturi.com")
389389
test.Assert(t, present, "Present should be true")
390390
test.Assert(t, valid, "Valid should be true")
391391

0 commit comments

Comments
 (0)