Uploaded image for project: 'EJBCA'
  1. EJBCA
  2. ECA-6156

Detect the last CNAME in a chain of CNAMEs to avoid unnecessary DNS queries

    Details

    • Type: Improvement
    • Status: Open
    • Priority: Minor
    • Resolution: Unresolved
    • Affects Version/s: None
    • Fix Version/s: None
    • Component/s: None
    • Labels:

      Description

      The CAA validator will follow the first CNAME, even if multiple CNAMES are returned.

      For example, consider the fictional query:
      > dig foo.com

      ; <<>> DiG 9.10.3-P4-Ubuntu <<>> foo.com
      ;; global options: +cmd
      ;; Got answer:
      ;; >>HEADER<< opcode: QUERY, status: NOERROR, id: 51847
      ;; flags: qr rd ra; QUERY: 1, ANSWER: 11, AUTHORITY: 0, ADDITIONAL: 1

      ;; OPT PSEUDOSECTION:
      ; EDNS: version: 0, flags:; udp: 512
      ;; QUESTION SECTION:
      ;foo.com IN A

      ;; ANSWER SECTION:
      foo.com. 276 IN CNAME foo2.com.
      foo2.com 276 IN CNAME foo3.com.

      foo.com. 59 IN A 1.2.3.5

      Currently we extract the target of the first CNAME (foo2.com) and make a new CAA query.

      What we should do is to order the CNAMEs in a list like this
      foo.com => foo2.com => foo3.com

      take the tail of that list and perform a CAA query there.

      If DNS servers always returns CNAMEs in order we would simply take the last CNAME from the response message and perform the query on that one.

        Attachments

          Activity

            People

            • Assignee:
              Unassigned
              Reporter:
              bastianf Bastian Fredriksson
            • Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

              • Created:
                Updated:

                Time Tracking

                Estimated:
                Original Estimate - 1 hour
                1h
                Remaining:
                Remaining Estimate - 1 hour
                1h
                Logged:
                Time Spent - Not Specified
                Not Specified