letsencrypt / letsencrypt/boulder
va: Validate Persistent DCV TXT Record parameter tags per RFC 8659
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 5.8k
- Forks
- 649
- Avg merge
- 3d 23h
- Merged PRs (30d)
- 24
Description
parseDNSPersistRecord in va/dns_persist.go, which validates the Persistent DCV TXT Record for BR Section 3.2.2.4.22 (DNS TXT Record with Persistent Value), does not validate the parameter tag against the RFC 8659 tag grammar. It accepts a tag containing characters the grammar disallows (for example foo_bar) and ignores it as an unknown parameter.
BR Section 3.2.2.4.22 requires the record to conform to that syntax:
- The RDATA value MUST conform to the
issue-valuesyntax as defined in RFC 8659, Section 4.2; and
So accepting a tag that does not match the RFC 8659 tag production could be a violation.
This is the same class of violation as the CAA path, where parseCAARecord accepted invalid (empty) parameter tags. See https://github.com/letsencrypt/boulder/pull/8977 for more details.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in va/dns_persist.go at parseDNSPersistRecord and read RFC 8659 Section 4.2 for the tag grammar. Compare the analogous CAA validation path and pull request 8977, then run the relevant va package tests. Done means Persistent DCV records with disallowed parameter-tag characters are rejected according to the RFC.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 78/100