Skip to content

Commit bdea281

Browse files
Roland Bracewell Shoemakerjsha
Roland Bracewell Shoemaker
authored and
jsha
committed
Remove CAA SERVFAIL exceptions code (letsencrypt#3262)
Fixes letsencrypt#3080.
1 parent 0684d5f commit bdea281

File tree

7 files changed

+4
-83
lines changed

7 files changed

+4
-83
lines changed

‎bdns/dns.go‎

Lines changed: 4 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@ package bdns
22

33
import (
44
"fmt"
5-
"io/ioutil"
65
"math/rand"
76
"net"
87
"strings"
@@ -157,11 +156,8 @@ type DNSClientImpl struct {
157156
dnsClient exchanger
158157
servers []string
159158
allowRestrictedAddresses bool
160-
// If non-nil, these are already-issued names whose registrar returns SERVFAIL
161-
// for CAA queries that get a temporary pass during a notification period.
162-
caaSERVFAILExceptions map[string]bool
163-
maxTries int
164-
clk clock.Clock
159+
maxTries int
160+
clk clock.Clock
165161

166162
queryTime *prometheus.HistogramVec
167163
totalLookupTime *prometheus.HistogramVec
@@ -180,7 +176,6 @@ type exchanger interface {
180176
func NewDNSClientImpl(
181177
readTimeout time.Duration,
182178
servers []string,
183-
caaSERVFAILExceptions map[string]bool,
184179
stats metrics.Scope,
185180
clk clock.Clock,
186181
maxTries int,
@@ -230,7 +225,6 @@ func NewDNSClientImpl(
230225
dnsClient: dnsClient,
231226
servers: servers,
232227
allowRestrictedAddresses: false,
233-
caaSERVFAILExceptions: caaSERVFAILExceptions,
234228
maxTries: maxTries,
235229
clk: clk,
236230
queryTime: queryTime,
@@ -244,7 +238,7 @@ func NewDNSClientImpl(
244238
// provided list of DNS servers for resolution and will allow loopback addresses.
245239
// This constructor should *only* be called from tests (unit or integration).
246240
func NewTestDNSClientImpl(readTimeout time.Duration, servers []string, stats metrics.Scope, clk clock.Clock, maxTries int) *DNSClientImpl {
247-
resolver := NewDNSClientImpl(readTimeout, servers, nil, stats, clk, maxTries)
241+
resolver := NewDNSClientImpl(readTimeout, servers, stats, clk, maxTries)
248242
resolver.allowRestrictedAddresses = true
249243
return resolver
250244
}
@@ -450,19 +444,8 @@ func (dnsClient *DNSClientImpl) LookupCAA(ctx context.Context, hostname string)
450444
return nil, &DNSError{dnsType, hostname, err, -1}
451445
}
452446

453-
// If the resolver returns SERVFAIL for a certain list of FQDNs, return an
454-
// empty set and no error. We originally granted a pass on SERVFAIL because
455-
// Cloudflare's DNS, which is behind a lot of hostnames, returned that code.
456-
// That is since fixed, but we have a handful of other domains that still return
457-
// SERVFAIL, but will need certificate renewals. After a suitable notice
458-
// period we will remove these exceptions.
459447
if r.Rcode == dns.RcodeServerFailure {
460-
if dnsClient.caaSERVFAILExceptions == nil ||
461-
dnsClient.caaSERVFAILExceptions[hostname] {
462-
return nil, nil
463-
} else {
464-
return nil, &DNSError{dnsType, hostname, nil, r.Rcode}
465-
}
448+
return nil, &DNSError{dnsType, hostname, nil, r.Rcode}
466449
}
467450

468451
var CAAs []*dns.CAA
@@ -495,22 +478,3 @@ func (dnsClient *DNSClientImpl) LookupMX(ctx context.Context, hostname string) (
495478

496479
return results, nil
497480
}
498-
499-
// ReadHostList reads in a newline-separated file and returns a map containing
500-
// each entry. If the filename is empty, returns a nil map and no error.
501-
func ReadHostList(filename string) (map[string]bool, error) {
502-
if filename == "" {
503-
return nil, nil
504-
}
505-
body, err := ioutil.ReadFile(filename)
506-
if err != nil {
507-
return nil, err
508-
}
509-
var output = make(map[string]bool)
510-
for _, v := range strings.Split(string(body), "\n") {
511-
if len(v) > 0 {
512-
output[v] = true
513-
}
514-
}
515-
return output, nil
516-
}

‎bdns/dns_test.go‎

Lines changed: 0 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -292,22 +292,9 @@ func TestDNSServFail(t *testing.T) {
292292
_, err = obj.LookupHost(context.Background(), bad)
293293
test.AssertError(t, err, "LookupHost didn't return an error")
294294

295-
// CAA lookup ignores validation failures from the resolver for now
296-
// and returns an empty list of CAA records.
297295
emptyCaa, err := obj.LookupCAA(context.Background(), bad)
298296
test.Assert(t, len(emptyCaa) == 0, "Query returned non-empty list of CAA records")
299-
test.AssertNotError(t, err, "LookupCAA returned an error")
300-
301-
// When we turn on enforceCAASERVFAIL, such lookups should fail.
302-
obj.caaSERVFAILExceptions = map[string]bool{"servfailexception.example.com": true}
303-
emptyCaa, err = obj.LookupCAA(context.Background(), bad)
304-
test.Assert(t, len(emptyCaa) == 0, "Query returned non-empty list of CAA records")
305297
test.AssertError(t, err, "LookupCAA should have returned an error")
306-
307-
// Unless they are on the exception list
308-
emptyCaa, err = obj.LookupCAA(context.Background(), "servfailexception.example.com")
309-
test.Assert(t, len(emptyCaa) == 0, "Query returned non-empty list of CAA records")
310-
test.AssertNotError(t, err, "LookupCAA for servfail exception returned an error")
311298
}
312299

313300
func TestDNSLookupTXT(t *testing.T) {
@@ -666,23 +653,3 @@ type tempError bool
666653

667654
func (t tempError) Temporary() bool { return bool(t) }
668655
func (t tempError) Error() string { return fmt.Sprintf("Temporary: %t", t) }
669-
670-
func TestReadHostList(t *testing.T) {
671-
res, err := ReadHostList("")
672-
if res != nil {
673-
t.Errorf("Expected res to be nil")
674-
}
675-
if err != nil {
676-
t.Errorf("Expected err to be nil: %s", err)
677-
}
678-
res, err = ReadHostList("../test/caa-servfail-exceptions.txt")
679-
if err != nil {
680-
t.Errorf("Expected err to be nil: %s", err)
681-
}
682-
if len(res) != 1 {
683-
t.Errorf("Wrong size of host list: %d", len(res))
684-
}
685-
if res["servfailexception.example.com"] != true {
686-
t.Errorf("Didn't find servfailexception.example.com in list")
687-
}
688-
}

‎cmd/boulder-ra/main.go‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -194,7 +194,6 @@ func main() {
194194
rai.DNSClient = bdns.NewDNSClientImpl(
195195
raDNSTimeout,
196196
[]string{c.Common.DNSResolver},
197-
nil,
198197
scope,
199198
cmd.Clock(),
200199
dnsTries)

‎cmd/boulder-va/main.go‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -33,9 +33,6 @@ type config struct {
3333
// will be turned into 1.
3434
DNSTries int
3535

36-
// Feature flag to enable enforcement of CAA SERVFAILs.
37-
CAASERVFAILExceptions string
38-
3936
RemoteVAs []cmd.GRPCClientConfig
4037
MaxRemoteValidationFailures int
4138

@@ -95,14 +92,11 @@ func main() {
9592
dnsTries = 1
9693
}
9794
clk := cmd.Clock()
98-
caaSERVFAILExceptions, err := bdns.ReadHostList(c.VA.CAASERVFAILExceptions)
99-
cmd.FailOnError(err, "Couldn't read CAASERVFAILExceptions file")
10095
var resolver bdns.DNSClient
10196
if !c.Common.DNSAllowLoopbackAddresses {
10297
r := bdns.NewDNSClientImpl(
10398
dnsTimeout,
10499
[]string{c.Common.DNSResolver},
105-
caaSERVFAILExceptions,
106100
scope,
107101
clk,
108102
dnsTries)

‎test/caa-servfail-exceptions.txt‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎test/config-next/va.json‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
{
22
"va": {
3-
"CAASERVFAILExceptions": "test/caa-servfail-exceptions.txt",
43
"userAgent": "boulder",
54
"debugAddr": ":8004",
65
"portConfig": {

‎test/config/va.json‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
{
22
"va": {
3-
"CAASERVFAILExceptions": "test/caa-servfail-exceptions.txt",
43
"userAgent": "boulder",
54
"debugAddr": ":8004",
65
"portConfig": {

0 commit comments

Comments
 (0)