{"action":"created","issue":{"url":"https://api.github.com/repos/letsencrypt/boulder/issues/532","labels_url":"https://api.github.com/repos/letsencrypt/boulder/issues/532/labels{/name}","comments_url":"https://api.github.com/repos/letsencrypt/boulder/issues/532/comments","events_url":"https://api.github.com/repos/letsencrypt/boulder/issues/532/events","html_url":"https://github.com/letsencrypt/boulder/pull/532","id":97215084,"number":532,"title":"Fix authz always failing when CAA record is not present + fix CAA lookup algorithm per RFC","user":{"login":"tomclegg","id":100187,"avatar_url":"https://avatars.githubusercontent.com/u/100187?v=3","gravatar_id":"","url":"https://api.github.com/users/tomclegg","html_url":"https://github.com/tomclegg","followers_url":"https://api.github.com/users/tomclegg/followers","following_url":"https://api.github.com/users/tomclegg/following{/other_user}","gists_url":"https://api.github.com/users/tomclegg/gists{/gist_id}","starred_url":"https://api.github.com/users/tomclegg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tomclegg/subscriptions","organizations_url":"https://api.github.com/users/tomclegg/orgs","repos_url":"https://api.github.com/users/tomclegg/repos","events_url":"https://api.github.com/users/tomclegg/events{/privacy}","received_events_url":"https://api.github.com/users/tomclegg/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/letsencrypt/boulder/labels/bug","name":"bug","color":"fc2929"},{"url":"https://api.github.com/repos/letsencrypt/boulder/labels/r=jcjones","name":"r=jcjones","color":"fbca04"},{"url":"https://api.github.com/repos/letsencrypt/boulder/labels/r=rolandshoemaker","name":"r=rolandshoemaker","color":"fbca04"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-07-25T10:15:32Z","updated_at":"2015-07-29T03:58:09Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/letsencrypt/boulder/pulls/532","html_url":"https://github.com/letsencrypt/boulder/pull/532","diff_url":"https://github.com/letsencrypt/boulder/pull/532.diff","patch_url":"https://github.com/letsencrypt/boulder/pull/532.patch"},"body":"I think this bug is responsible for the integration test failures reported in #517.\r\n\r\n```\r\n2015/07/23 00:03:07 [AUDIT] Internal error - Error creating new authz - DNS failure: 3-NXDOMAIN for CNAME query\r\n```\r\n\r\nLookupCAA in `core/dns.go` used to do CNAME lookups, and look up CAA for the target if one was found.\r\n\r\nIn #413, that logic moved into `getCAASet()` in `va/validation-authority.go`, but the new code considered NXDOMAIN during CNAME lookup to be an error. This caused `CheckCAARecords` to error out when a CAA record didn't exist, instead of returning `valid==true && present==false` as expected.\r\n\r\nThis PR restores the \"NXDOMAIN is not an error\" behavior, and adds tests.\r\n\r\nIt also improves `getCAASet()` CNAME support by following a chain of up to 16 CNAME records, not just one. (I figure we want to resolve CNAMEs just like other DNS resolvers, right?) The previous code (even before #413) was returning \"valid\" for a case like `CNAME->CNAME->invalidCAA` and infinite loops of CNAMEs. Those are now treated as \"invalid\" and \"error\" respectively.\r\n\r\n(It seems to me CNAME logic really belongs in the DNS resolver library -- it's just part of how names get resolved and isn't specific to the process of evaluating CAA records -- but it just moved _from_ there, so I left it where it is.)\r\n\r\n(Update) This branch now treats CNAME and DNAME as specified in rfc6844, i.e., if a name has no CAA record of its own (or via usual CNAME logic), but does have a CNAME, check the parent domains of the CNAME target rather than the parent domains of the original name. Cases where correct behavior is not specified in rfc6844 (e.g., infinite loops and non-identical CNAME/DNAME records listed for the same name) result in an error."},"comment":{"url":"https://api.github.com/repos/letsencrypt/boulder/issues/comments/125832088","html_url":"https://github.com/letsencrypt/boulder/pull/532#issuecomment-125832088","issue_url":"https://api.github.com/repos/letsencrypt/boulder/issues/532","id":125832088,"user":{"login":"rolandshoemaker","id":5080674,"avatar_url":"https://avatars.githubusercontent.com/u/5080674?v=3","gravatar_id":"","url":"https://api.github.com/users/rolandshoemaker","html_url":"https://github.com/rolandshoemaker","followers_url":"https://api.github.com/users/rolandshoemaker/followers","following_url":"https://api.github.com/users/rolandshoemaker/following{/other_user}","gists_url":"https://api.github.com/users/rolandshoemaker/gists{/gist_id}","starred_url":"https://api.github.com/users/rolandshoemaker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rolandshoemaker/subscriptions","organizations_url":"https://api.github.com/users/rolandshoemaker/orgs","repos_url":"https://api.github.com/users/rolandshoemaker/repos","events_url":"https://api.github.com/users/rolandshoemaker/events{/privacy}","received_events_url":"https://api.github.com/users/rolandshoemaker/received_events","type":"User","site_admin":false},"created_at":"2015-07-29T03:58:09Z","updated_at":"2015-07-29T03:58:09Z","body":"Recheck r+, merging."}}