RVA: Recheck CAA records

cmd/boulder-va/main.go

@@ -125,8 +125,11 @@ func main() {
 			remotes = append(
 				remotes,
 				va.RemoteVA{
-					VAClient: vapb.NewVAClient(vaConn),
-					Address:  rva.ServerAddress,
+					RemoteClients: va.RemoteClients{
+						VAClient:  vapb.NewVAClient(vaConn),
+						CAAClient: vapb.NewCAAClient(vaConn),
+					},
+					Address: rva.ServerAddress,
 				},
 			)
 		}

features/features.go

@@ -87,6 +87,15 @@ type Config struct {
 
 	// DOH enables DNS-over-HTTPS queries for validation
 	DOH bool
+
+	// EnforceMultiCAA causes the VA to block on remote VA CAA recheck requests
+	// in order to make a valid/invalid decision with the results.
+	EnforceMultiCAA bool
+
+	// MultiCAAFullResults will cause the main VA to wait for all of the remote
+	// VA CAA recheck results, not just the threshold required to make a
+	// decision.
+	MultiCAAFullResults bool
 }
 
 var fMu = new(sync.RWMutex)

ra/ra.go

@@ -878,7 +878,7 @@ func (ra *RegistrationAuthorityImpl) checkAuthorizationsCAA(
 	return nil
 }
 
-// recheckCAA accepts a list of of names that need to have their CAA records
+// recheckCAA accepts a list of names that need to have their CAA records
 // rechecked because their associated authorizations are sufficiently old and
 // performs the CAA checks required for each. If any of the rechecks fail an
 // error is returned.

ra/ra_test.go

@@ -157,14 +157,14 @@ func numAuthorizations(o *corepb.Order) int {
 }
 
 type DummyValidationAuthority struct {
-	request      chan *vapb.PerformValidationRequest
-	ResultError  error
-	ResultReturn *vapb.ValidationResult
+	performValidationRequest             chan *vapb.PerformValidationRequest
+	PerformValidationRequestResultError  error
+	PerformValidationRequestResultReturn *vapb.ValidationResult
 }
 
 func (dva *DummyValidationAuthority) PerformValidation(ctx context.Context, req *vapb.PerformValidationRequest, _ ...grpc.CallOption) (*vapb.ValidationResult, error) {
-	dva.request <- req
-	return dva.ResultReturn, dva.ResultError
+	dva.performValidationRequest <- req
+	return dva.PerformValidationRequestResultReturn, dva.PerformValidationRequestResultError
 }
 
 var (
@@ -323,7 +323,9 @@ func initAuthorities(t *testing.T) (*DummyValidationAuthority, sapb.StorageAutho
 
 	saDBCleanUp := test.ResetBoulderTestDatabase(t)
 
-	va := &DummyValidationAuthority{request: make(chan *vapb.PerformValidationRequest, 1)}
+	va := &DummyValidationAuthority{
+		performValidationRequest: make(chan *vapb.PerformValidationRequest, 1),
+	}
 
 	pa, err := policy.New(map[core.AcmeChallenge]bool{
 		core.ChallengeTypeHTTP01: true,
@@ -818,7 +820,7 @@ func TestPerformValidationAlreadyValid(t *testing.T) {
 	authzPB, err := bgrpc.AuthzToPB(authz)
 	test.AssertNotError(t, err, "bgrpc.AuthzToPB failed")
 
-	va.ResultReturn = &vapb.ValidationResult{
+	va.PerformValidationRequestResultReturn = &vapb.ValidationResult{
 		Records: []*corepb.ValidationRecord{
 			{
 				AddressUsed: []byte("192.168.0.1"),
@@ -847,7 +849,7 @@ func TestPerformValidationSuccess(t *testing.T) {
 	// We know this is OK because of TestNewAuthorization
 	authzPB := createPendingAuthorization(t, sa, Identifier, fc.Now().Add(12*time.Hour))
 
-	va.ResultReturn = &vapb.ValidationResult{
+	va.PerformValidationRequestResultReturn = &vapb.ValidationResult{
 		Records: []*corepb.ValidationRecord{
 			{
 				AddressUsed: []byte("192.168.0.1"),
@@ -869,7 +871,7 @@ func TestPerformValidationSuccess(t *testing.T) {
 
 	var vaRequest *vapb.PerformValidationRequest
 	select {
-	case r := <-va.request:
+	case r := <-va.performValidationRequest:
 		vaRequest = r
 	case <-time.After(time.Second):
 		t.Fatal("Timed out waiting for DummyValidationAuthority.PerformValidation to complete")
@@ -908,7 +910,7 @@ func TestPerformValidationVAError(t *testing.T) {
 
 	authzPB := createPendingAuthorization(t, sa, Identifier, fc.Now().Add(12*time.Hour))
 
-	va.ResultError = fmt.Errorf("Something went wrong")
+	va.PerformValidationRequestResultError = fmt.Errorf("Something went wrong")
 
 	challIdx := dnsChallIdx(t, authzPB.Challenges)
 	authzPB, err := ra.PerformValidation(ctx, &rapb.PerformValidationRequest{
@@ -920,7 +922,7 @@ func TestPerformValidationVAError(t *testing.T) {
 
 	var vaRequest *vapb.PerformValidationRequest
 	select {
-	case r := <-va.request:
+	case r := <-va.performValidationRequest:
 		vaRequest = r
 	case <-time.After(time.Second):
 		t.Fatal("Timed out waiting for DummyValidationAuthority.PerformValidation to complete")

test/config-next/va.json

@@ -41,6 +41,8 @@
 			"EnforceMultiVA": true,
 			"MultiVAFullResults": true,
 			"CAAAfterValidation": true,
+			"EnforceMultiCAA": true,
+			"MultiCAAFullResults": true,
 			"DOH": true
 		},
 		"remoteVAs": [