Skip to content

Commit a2a021a

Browse files
apio-sysapio-sys
authored
Merge branch 'internetstandards:main' into main
2 parents a4e7971 + 66f3f5e commit a2a021a

File tree

9 files changed

+349
-26080
lines changed

9 files changed

+349
-26080
lines changed

‎checks/caa/retrieval.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212

1313
CAA_MSGID_INSUFFICIENT_POLICY = "missing-required-property-issue"
1414
CAA_TAGS_REQUIRED = {"issue"}
15-
CAA_MAX_RECORDS = 1000
15+
CAA_MAX_RECORDS = 100
1616

1717

1818
@dataclass

‎checks/resolver.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ def dns_resolve_tlsa(qname: str, allow_bogus=True) -> tuple[list[TLSA], DNSSECSt
6868

6969
def dns_resolve_txt(qname: str, allow_bogus=True) -> list[str]:
7070
rrset, dnssec_status = dns_resolve(qname, RdataType.TXT, allow_bogus)
71-
return [rr.to_text()[1:-1] for rr in rrset]
71+
return ["".join([dns.rdata._escapify(s) for s in rr.strings]) for rr in rrset]
7272

7373

7474
def dns_resolve_spf(qname: str, allow_bogus=True) -> Optional[str]:

‎documentation/Docker-container-profiles.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Docker container profiles overview
22

3-
This overview was last generated at 2025-02-09T23:19:39Z with `make update_container_documentation`.
3+
This overview was last generated at 2025-05-27T12:11:00Z with `make update_container_documentation`.
44

55

66
| container | profiles | description |

‎documentation/caa.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ In all other cases, the status is bad (notice).
4646
* We do not check whether the current TLS certificate matches
4747
one or more of the `issue*` records, i.e. whether the current
4848
certificate could be re-issued.
49-
* We do not evaluate more than 1000 records.
49+
* We do not evaluate more than 100 records.
5050
* The API and database support a "recommendations" field for future use,
5151
but none are currently detected.
5252
* We do not accept HTTP URLs in iodef, which may be a slightly

‎remote_data/certs/certdata.txt‎

Lines changed: 0 additions & 25972 deletions
Large diffs are not rendered by default.

‎remote_data/dns/root.key‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,10 @@
11
; autotrust trust anchor file
22
;;id: . 1
3-
;;last_queried: 1736366165 ;;Wed Jan 8 20:56:05 2025
4-
;;last_success: 1736366165 ;;Wed Jan 8 20:56:05 2025
5-
;;next_probe_time: 1736408952 ;;Thu Jan 9 08:49:12 2025
3+
;;last_queried: 1748347868 ;;Tue May 27 14:11:08 2025
4+
;;last_success: 1748347868 ;;Tue May 27 14:11:08 2025
5+
;;next_probe_time: 1748388858 ;;Wed May 28 01:34:18 2025
66
;;query_failed: 0
77
;;query_interval: 43200
88
;;retry_time: 8640
9+
. 86400 IN DNSKEY 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdpWWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwuMoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBevYtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ;{id = 38696 (ksk), size = 2048b} ;;state=1 [ ADDPEND ] ;;count=1 ;;lastchange=1748347868 ;;Tue May 27 14:11:08 2025
910
. 172800 IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ;{id = 20326 (ksk), size = 2048b} ;;state=2 [ VALID ] ;;count=0 ;;lastchange=1519657238 ;;Mon Feb 26 16:00:38 2018

‎remote_data/macs/padded_macs.json‎

Lines changed: 1 addition & 1 deletion
Large diffs are not rendered by default.

‎translations/en/main.po‎

Lines changed: 171 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ msgstr ""
99
"Project-Id-Version: PACKAGE VERSION\n"
1010
"Report-Msgid-Bugs-To: \n"
1111
"POT-Creation-Date: 2015-02-16 23:27+0100\n"
12-
"PO-Revision-Date: 2025-01-28 12:01:21.412632\n"
12+
"PO-Revision-Date: 2025-05-27 12:27:29.821689\n"
1313
"Last-Translator: \n"
1414
"Language-Team: \n"
1515
"Language: \n"
@@ -35,7 +35,7 @@ msgstr ""
3535
"\n"
3636
"[PGP public key](/static/question@internet.nl_0x45028563.asc) \n"
3737
"Fingerprint: ACB7 8829 4C7E 12BA E922 8C60 D894 E15F 4502 8563 \n"
38-
"Expiration date: 19th of March 2025"
38+
"Expiration date: 28th of March 2028"
3939

4040
#, md-format
4141
msgid "about content"
@@ -1105,6 +1105,46 @@ msgstr ""
11051105
"This subtest did *not* run, because *no* route announcement was available "
11061106
"for any of the IP addresses."
11071107

1108+
msgid "detail mail tls caa exp"
1109+
msgstr ""
1110+
"We check if the name servers of each of your receiving mail servers (MX) contain one or more CAA records, that are syntactically valid and sufficiently protective.\n"
1111+
"\n"
1112+
"Certification Authority Authorisation (CAA) allows you as a DNS domain name holder to specify one or more certificate authority authorised to issue certificates for your mail server domain names.\n"
1113+
"A certificate authority must not issue a certificate unless the certificate authority determines that the certificate request is consistent with the applicable CAA records.\n"
1114+
"\n"
1115+
"Note that CAA records are located during validation by walking up the DNS hierarchy until one or more records are found.\n"
1116+
"For example, if no CAA records are found on `sub.example.nl`, `example.nl` will be queried.\n"
1117+
"The domain were the applicable CAA records are found is shown in the table with technical details below.\n"
1118+
"\n"
1119+
"The verdict is good if one or more CAA records were found that all have correct syntax, and at least one of these CAA records has the `issue` tag.\n"
1120+
"In all other cases, the test will result in a fail.\n"
1121+
"It is not checked whether the certificate authority of the current TLS certificate matches one or more of the `issue` and `issuewild` values, i.e., whether the current certificate could be reissued at this time.\n"
1122+
"\n"
1123+
"If your are using the Automatic Certificate Management Environment (ACME) standard and your certificate authority supports it, we recommend you to use the parameters `validationmethods` and `accounturi` to further restrict isssuance by the authorised certificate authority. Furthermore, it is recommended to add `issuemail` and `issuevmc` with an empty `;` if you do not use certificates for S/MIME and/or BIMI respectively. Otherwise, any certificate authority is still allowed to issue these certificates for your domain, since `issue` does not cover them.\n"
1124+
"\n"
1125+
"We expect URLs in `iodef` to be secure (i.e. use HTTPS scheme).\n"
1126+
"Furthermore, to prevent suppression or spoofing of CAA records we strongly recommend you to use DNSSEC, although this CAA test does not specifically test for DNSSEC.\n"
1127+
"\n"
1128+
"*Requirement level: Recommended*"
1129+
1130+
msgid "detail mail tls caa label"
1131+
msgstr "CAA for mail server"
1132+
1133+
msgid "detail mail tls caa tech table"
1134+
msgstr "Mail server|Findings"
1135+
1136+
msgid "detail mail tls caa verdict bad"
1137+
msgstr "Your mail server does *not* have CAA."
1138+
1139+
msgid "detail mail tls caa verdict good"
1140+
msgstr "Your mail server has a valid, sufficiently protective CAA. "
1141+
1142+
msgid "detail mail tls caa verdict insufficient"
1143+
msgstr "Your mail server has a valid, but *unsufficiently* protective CAA."
1144+
1145+
msgid "detail mail tls caa verdict syntax-error"
1146+
msgstr "Your mail server has an *invalid* CAA."
1147+
11081148
msgid "detail mail tls cert-hostmatch exp"
11091149
msgstr ""
11101150
"We check if the domain name of each of your receiving mail servers (MX) matches the domain name on the presented certificates. \n"
@@ -1859,6 +1899,86 @@ msgstr ""
18591899
msgid "detail tech data bogus"
18601900
msgstr "bogus"
18611901

1902+
msgid "detail tech data caa caa-record"
1903+
msgstr "Record: {record}"
1904+
1905+
msgid "detail tech data caa caa_record"
1906+
msgstr "caa record found: {record}"
1907+
1908+
msgid "detail tech data caa found-host"
1909+
msgstr "CAA found on: {host}"
1910+
1911+
msgid "detail tech data caa found_host"
1912+
msgstr "found CAA on host {host}"
1913+
1914+
msgid "detail tech data caa invalid-flags-reserved-bits"
1915+
msgstr "Error: Invalid reserved flags \"{flags}\""
1916+
1917+
msgid "detail tech data caa invalid-parameter-validation-methods"
1918+
msgstr "Error: Invalid 'validationmethods' value \"{parameter_value}\""
1919+
1920+
msgid "detail tech data caa invalid-property-contactemail-value"
1921+
msgstr "Error: Invalid 'contactemail' value \"{property_value}\""
1922+
1923+
msgid "detail tech data caa invalid-property-contactphone-value"
1924+
msgstr "Error: Invalid 'contactphone' value \"{property_value}\""
1925+
1926+
msgid "detail tech data caa invalid-property-iodef-value"
1927+
msgstr "Error: Invalid 'iodef' value \"{property_value}\""
1928+
1929+
msgid "detail tech data caa invalid-property-issuemail-value"
1930+
msgstr "Error: Invalid 'issuemail' value \"{property_value}\""
1931+
1932+
msgid "detail tech data caa invalid-property-syntax"
1933+
msgstr ""
1934+
"Error: Invalid \"{invalid_character}\" at position "
1935+
"{invalid_character_position} in '{property_name}' value \"{property_value}\""
1936+
" "
1937+
1938+
msgid "detail tech data caa invalid-reserved-property"
1939+
msgstr "Error: Invalid reserved property \"{property_tag}\""
1940+
1941+
msgid "detail tech data caa invalid-unknown-property"
1942+
msgstr "Error: Unknown property \"{property_tag}\""
1943+
1944+
msgid "detail tech data caa invalid_flags_reserved_bits"
1945+
msgstr "invalid_flags_reserved_bits {value}"
1946+
1947+
msgid "detail tech data caa invalid_property_contactemail_value"
1948+
msgstr "invalid_property_contactemail_value {value}"
1949+
1950+
msgid "detail tech data caa invalid_property_contactphone_value"
1951+
msgstr "invalid_property_contactphone_value {value}"
1952+
1953+
msgid "detail tech data caa invalid_property_iodef_value"
1954+
msgstr "invalid_property_iodef_value {value}"
1955+
1956+
msgid "detail tech data caa invalid_property_issue_validation_method"
1957+
msgstr "invalid_property_issue_validation_method {value}"
1958+
1959+
msgid "detail tech data caa invalid_property_issuemail_value"
1960+
msgstr "invalid_property_issuemail_value {value}"
1961+
1962+
msgid "detail tech data caa invalid_property_syntax"
1963+
msgstr ""
1964+
"invalid_property_syntax name {property_name} value {property_value} invalid "
1965+
"character {invalid_character} at pos {invalid_character_position}"
1966+
1967+
msgid "detail tech data caa invalid_reserved_property"
1968+
msgstr "invalid_reserved_property {value}"
1969+
1970+
msgid "detail tech data caa invalid_unknown_property"
1971+
msgstr "invalid_unknown_property {value}"
1972+
1973+
msgid "detail tech data caa missing-required-property-issue"
1974+
msgstr "Error: Required 'issue' property missing"
1975+
1976+
msgid "detail tech data caa not-found"
1977+
msgstr "Error: CAA not found"
1978+
1979+
msgid "detail tech data caa not_found"
1980+
msgstr "CAA not found"
1981+
18621982
msgid "detail tech data good"
18631983
msgstr "good"
18641984

@@ -2652,6 +2772,45 @@ msgstr ""
26522772
"This subtest did *not* run, because *no* route announcement was available "
26532773
"for any of the IP addresses."
26542774

2775+
msgid "detail web tls caa exp"
2776+
msgstr ""
2777+
"We check if the name servers of your website domain contain one or more CAA records, that are syntactically valid and sufficiently protective.\n"
2778+
"\n"
2779+
"Certification Authority Authorisation (CAA) allows you as a DNS domain name holder to specify one or more certificate authorities authorised to issue certificates for your domain name.\n"
2780+
"A certificate authority must not issue a certificate unless the CA determines that the certificate request is consistent with the applicable CAA records.\n"
2781+
"\n"
2782+
"Note that CAA records are located during validation by walking up the DNS hierarchy until one or more records are found.\n"
2783+
"For example, if no CAA records are found on `sub.example.nl`, `example.nl` will be queried.\n"
2784+
"The domain were the applicable CAA records are found is shown in the table with technical details below.\n"
2785+
"\n"
2786+
"The verdict is good if one or more CAA records were found that all have correct syntax, and at least one of these CAA records has the `issue` tag with a valid value.\n"
2787+
"In all other cases, the test will result in a fail. It is not checked whether the certificate authority of the current certificate matches one or more of the `issue` and `issuewild` values, i.e., whether the current certificate could be reissued at this time.\n"
2788+
"\n"
2789+
"If your are using the Automatic Certificate Management Environment (ACME) standard and your certificate authority supports it, we recommend you to use the parameters `validationmethods` and `accounturi` to further restrict isssuance by the authorised certificate authority. Furthermore, it is recommended to add `issuemail` and `issuevmc` with an empty `;` if you do not use certificates for S/MIME and/or BIMI respectively. Otherwise, any certificate authority is still allowed to issue these certificates for your domain, since `issue` does not cover them.\n"
2790+
"\n"
2791+
"We expect URLs in `iodef` to be secure (i.e. use HTTPS scheme). \n"
2792+
"Furthermore, to prevent suppression or spoofing of CAA records we strongly recommend you to use DNSSEC, although this CAA test does not specifically test for DNSSEC.\n"
2793+
"\n"
2794+
"*Requirement level: Recommended*"
2795+
2796+
msgid "detail web tls caa label"
2797+
msgstr "CAA for domain"
2798+
2799+
msgid "detail web tls caa tech table"
2800+
msgstr "Findings"
2801+
2802+
msgid "detail web tls caa verdict bad"
2803+
msgstr "Your domain does *not* have CAA."
2804+
2805+
msgid "detail web tls caa verdict good"
2806+
msgstr "Your domain has a valid, sufficiently protective CAA. "
2807+
2808+
msgid "detail web tls caa verdict insufficient"
2809+
msgstr "Your domain has a valid, but *unsufficiently* protective CAA."
2810+
2811+
msgid "detail web tls caa verdict syntax-error"
2812+
msgstr "Your domain has an *invalid* CAA."
2813+
26552814
msgid "detail web tls cert-hostmatch exp"
26562815
msgstr ""
26572816
"We check if the domain name of your website matches the domain name on the certificate. \n"
@@ -3868,10 +4027,20 @@ msgstr ""
38684027
"* [How HTTPS works](https://howhttps.works/)\n"
38694028
"\n"
38704029
"## Specifications\n"
4030+
"### HTTPS\n"
38714031
"* [RFC 9110: HTTP Semantics](https://www.rfc-editor.org/rfc/rfc9110)\n"
38724032
"* [RFC 8446: The Transport Layer Security (TLS) Protocol Version 1.3](https://www.rfc-editor.org/rfc/rfc8446)\n"
38734033
"* [RFC 5246: The Transport Layer Security (TLS) Protocol, Version 1.2](https://www.rfc-editor.org/rfc/rfc5246)\n"
4034+
"* [RFC 9325:Recommendations for Secure Use of Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS)](https://www.rfc-editor.org/rfc/rfc9325.html)\n"
38744035
"* [RFC 6797: HTTP Strict Transport Security (HSTS)](https://www.rfc-editor.org/rfc/rfc6797)\n"
4036+
"\n"
4037+
"### CAA\n"
4038+
"* [RFC8659: DNS Certification Authority Authorization (CAA) Resource Record](https://www.rfc-editor.org/rfc/rfc8659.html)\n"
4039+
"* [RFC8657: Certification Authority Authorization (CAA) Record Extensions for Account URI and Automatic Certificate Management Environment (ACME) Method Binding](https://www.rfc-editor.org/rfc/rfc8657.html) \n"
4040+
"* [Baseline Requirements by Certification Authority Browser Forum](https://cabforum.org/working-groups/server/baseline-requirements/requirements/)\n"
4041+
"* [Certification Authority Restriction Properties by IANA](https://www.iana.org/assignments/pkix-parameters/pkix-parameters.xhtml#caa-properties)\n"
4042+
"\n"
4043+
"### DANE\n"
38754044
"* [RFC 6698: The DNS-Based Authentication of Named Entities (DANE) Transport Layer Security (TLS) Protocol: TLSA](https://www.rfc-editor.org/rfc/rfc6698)"
38764045

38774046
#, md-format
@@ -5367,51 +5536,3 @@ msgstr ""
53675536
"# Website test widget\n"
53685537
"Would you like visitors of your website to be able to directly start a website test? \n"
53695538
"Copy the HTML and CSS code from the text fields below into the source code of your website."
5370-
5371-
msgid "detail web tls caa label"
5372-
msgstr "CAA web"
5373-
5374-
msgid "detail mail tls caa label"
5375-
msgstr "CAA mail"
5376-
5377-
msgid "detail web tls caa tech table"
5378-
msgstr "Findings"
5379-
5380-
msgid "detail mail tls caa tech table"
5381-
msgstr "Mail server|Findings"
5382-
5383-
msgid "detail tech data caa caa_record"
5384-
msgstr "caa record found: {record}"
5385-
5386-
msgid "detail tech data caa invalid_property_syntax"
5387-
msgstr "invalid_property_syntax name {property_name} value {property_value} invalid character {invalid_character} at pos {invalid_character_position}"
5388-
5389-
msgid "detail tech data caa invalid_unknown_property"
5390-
msgstr "invalid_unknown_property {value}"
5391-
5392-
msgid "detail tech data caa invalid_reserved_property"
5393-
msgstr "invalid_reserved_property {value}"
5394-
5395-
msgid "detail tech data caa invalid_flags_reserved_bits"
5396-
msgstr "invalid_flags_reserved_bits {value}"
5397-
5398-
msgid "detail tech data caa invalid_property_issuemail_value"
5399-
msgstr "invalid_property_issuemail_value {value}"
5400-
5401-
msgid "detail tech data caa invalid_property_contactphone_value"
5402-
msgstr "invalid_property_contactphone_value {value}"
5403-
5404-
msgid "detail tech data caa invalid_property_contactemail_value"
5405-
msgstr "invalid_property_contactemail_value {value}"
5406-
5407-
msgid "detail tech data caa invalid_property_iodef_value"
5408-
msgstr "invalid_property_iodef_value {value}"
5409-
5410-
msgid "detail tech data caa invalid_property_issue_validation_method"
5411-
msgstr "invalid_property_issue_validation_method {value}"
5412-
5413-
msgid "detail tech data caa found_host"
5414-
msgstr "found CAA on host {host}"
5415-
5416-
msgid "detail tech data caa not_found"
5417-
msgstr "CAA not found"

0 commit comments

Comments
 (0)