letsencrypt / letsencrypt/boulder
wfe: Add IP address rendering check to prepAuthorizationForDisplay
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 5.8k
- Forks
- 649
- Avg merge
- 3d 23h
- Merged PRs (30d)
- 24
Description
RFC 8738 places a restriction on the format in which we render IP address identifiers to ACME clients:
The value field of the identifier MUST contain the textual form of the address as defined in Section 2.1 of [RFC1123] for IPv4 and in Section 4 of [RFC5952] for IPv6.
We pass all identifiers received in new-order requests through policy.ValidIP, which ensures this.
However, we should augment this request-time enforcement with a render-time check inside wfe.prepAuthorizationForDisplay.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in wfe2/wfe.go at prepAuthorizationForDisplay and compare its identifier rendering with policy.ValidIP. Use the RFC 1123 and RFC 5952 formatting requirements to determine the render-time validation behavior, then add coverage for IPv4 and IPv6 identifiers; done when non-compliant rendered identifiers are handled according to the existing WFE conventions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- api
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100