[v9_9] add CAA rdata support

3056.	[protocol]	Added support for CAA record type (RFC 6844).
			[RT #36625]

(cherry picked from commit eb898fa6)

CHANGES

+3056.	[protocol]	Added support for CAA record type (RFC 6844).
+			[RT #36625]
+
 3900.	[bug]		Fix a crash in PostgreSQL DLZ driver. [RT #36637]
 
 3899.	[bug]		"request-ixfr" is only applicable to slave and redirect

bin/tests/rdata_test.c

@@ -15,8 +15,6 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rdata_test.c,v 1.52 2011/08/28 09:10:41 marka Exp $ */
-
 #include <config.h>
 
 #include <stdlib.h>
@@ -284,6 +282,11 @@ viastruct(dns_rdata_t *rdata, isc_mem_t *mctx,
 		result = dns_rdata_tostruct(rdata, sp = &uri, NULL);
 		break;
 	}
+	case dns_rdatatype_caa: {
+		static dns_rdata_caa_t caa;
+		result = dns_rdata_tostruct(rdata, sp = &caa, NULL);
+		break;
+	}
 	case dns_rdatatype_wks: {
 		static dns_rdata_in_wks_t in_wks;
 		result = dns_rdata_tostruct(rdata, sp = &in_wks, NULL);
@@ -551,6 +554,11 @@ viastruct(dns_rdata_t *rdata, isc_mem_t *mctx,
 		result = dns_rdata_tostruct(rdata, sp = &uri, mctx);
 		break;
 	}
+	case dns_rdatatype_caa: {
+		static dns_rdata_caa_t caa;
+		result = dns_rdata_tostruct(rdata, sp = &caa, mctx);
+		break;
+	}
 	case dns_rdatatype_wks: {
 		static dns_rdata_in_wks_t in_wks;
 		result = dns_rdata_tostruct(rdata, sp = &in_wks, mctx);
@@ -848,6 +856,11 @@ viastruct(dns_rdata_t *rdata, isc_mem_t *mctx,
 		result = dns_rdata_fromstruct(rdata2, rdc, rdt, &uri, b);
 		break;
 	}
+	case dns_rdatatype_caa: {
+		dns_rdata_caa_t caa;
+		result = dns_rdata_fromstruct(rdata2, rdc, rdt, &caa, b);
+		break;
+	}
 	case dns_rdatatype_wks: {
 		dns_rdata_in_wks_t in_wks;
 		result = dns_rdata_fromstruct(rdata2, rdc, rdt, &in_wks, b);

bin/tests/system/genzone.sh

@@ -305,6 +305,11 @@ eui64			EUI64	01-23-45-67-89-ab-cd-ef
 uri01			URI	10 20 "https://www.isc.org/"
 uri02			URI	30 40 "https://www.isc.org/HolyCowThisSureIsAVeryLongURIRecordIDontEvenKnowWhatSomeoneWouldEverWantWithSuchAThingButTheSpecificationRequiresThatWesupportItSoHereWeGoTestingItLaLaLaLaLaLaLaSeriouslyThoughWhyWouldYouEvenConsiderUsingAURIThisLongItSeemsLikeASillyIdeaButEnhWhatAreYouGonnaDo/"
 
+; type 257
+caa01                   CAA     0 issue "ca.example.net; policy=ev"
+caa02                   CAA     128 tbs "Unknown"
+
+; keydata (internal type used for managed-keys)
 keydata			TYPE65533	\# 0
 keydata			TYPE65533	\# 6 010203040506 
 keydata			TYPE65533	\# 18 010203040506010203040506010203040506

bin/tests/system/xfer/dig1.good

@@ -9,6 +9,8 @@ a601.example.		3600	IN	A6	127 ::1 foo.
 a601.example.		3600	IN	A6	128  .
 afsdb01.example.	3600	IN	AFSDB	0 hostname.example.
 afsdb02.example.	3600	IN	AFSDB	65535 .
+caa01.example.		3600	IN	CAA	0 issue "ca.example.net\; policy=ev"
+caa02.example.		3600	IN	CAA	128 tbs "Unknown"
 cdnskey01.example.	3600	IN	CDNSKEY	512 255 1 AQMFD5raczCJHViKtLYhWGz8hMY9UGRuniJDBzC7w0aRyzWZriO6i2od GWWQVucZqKVsENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esga60z yGW6LFe9r8n6paHrlG5ojqf0BaqHT+8=
 cds01.example.		3600	IN	CDS	30795 1 1 310D27F4D82C1FC2400704EA9939FE6E1CEAA3B9
 cert01.example.		3600	IN	CERT	65534 65535 PRIVATEOID MxFcby9k/yvedMfQgKzhH5er0Mu/vILz45IkskceFGgiWCn/GxHhai6V AuHAoNUz4YoU1tVfSCSqQYn6//11U6Nld80jEeC8aTrO+KKmCaY=

bin/tests/system/xfer/dig2.good

@@ -9,6 +9,8 @@ a601.example.		3600	IN	A6	127 ::1 foo.
 a601.example.		3600	IN	A6	128  .
 afsdb01.example.	3600	IN	AFSDB	0 hostname.example.
 afsdb02.example.	3600	IN	AFSDB	65535 .
+caa01.example.		3600	IN	CAA	0 issue "ca.example.net\; policy=ev"
+caa02.example.		3600	IN	CAA	128 tbs "Unknown"
 cdnskey01.example.	3600	IN	CDNSKEY	512 255 1 AQMFD5raczCJHViKtLYhWGz8hMY9UGRuniJDBzC7w0aRyzWZriO6i2od GWWQVucZqKVsENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esga60z yGW6LFe9r8n6paHrlG5ojqf0BaqHT+8=
 cds01.example.		3600	IN	CDS	30795 1 1 310D27F4D82C1FC2400704EA9939FE6E1CEAA3B9
 cert01.example.		3600	IN	CERT	65534 65535 PRIVATEOID MxFcby9k/yvedMfQgKzhH5er0Mu/vILz45IkskceFGgiWCn/GxHhai6V AuHAoNUz4YoU1tVfSCSqQYn6//11U6Nld80jEeC8aTrO+KKmCaY=

bin/tests/system/xfer/tests.sh

@@ -27,7 +27,7 @@ status=0
 echo "I:testing basic zone transfer functionality"
 $DIG $DIGOPTS example. \
 	@10.53.0.2 axfr -p 5300 > dig.out.ns2 || status=1
-grep ";" dig.out.ns2
+grep "^;" dig.out.ns2
 
 #
 # Spin to allow the zone to tranfer.
@@ -37,13 +37,13 @@ do
 tmp=0
 $DIG $DIGOPTS example. \
 	@10.53.0.3 axfr -p 5300 > dig.out.ns3 || tmp=1
-	grep ";" dig.out.ns3 > /dev/null
+	grep "^;" dig.out.ns3 > /dev/null
 	if test $? -ne 0 ; then break; fi
 	echo "I: plain zone re-transfer"
 	sleep 5
 done
 if test $tmp -eq 1 ; then status=1; fi
-grep ";" dig.out.ns3
+grep "^;" dig.out.ns3
 
 $PERL ../digcomp.pl dig1.good dig.out.ns2 || status=1
 
@@ -53,7 +53,7 @@ echo "I:testing TSIG signed zone transfers"
 $DIG $DIGOPTS tsigzone. \
     	@10.53.0.2 axfr -y tsigzone.:1234abcd8765 -p 5300 \
 	> dig.out.ns2 || status=1
-grep ";" dig.out.ns2
+grep "^;" dig.out.ns2
 
 #
 # Spin to allow the zone to tranfer.
@@ -64,13 +64,13 @@ tmp=0
 $DIG $DIGOPTS tsigzone. \
     	@10.53.0.3 axfr -y tsigzone.:1234abcd8765 -p 5300 \
 	> dig.out.ns3 || tmp=1
-	grep ";" dig.out.ns3 > /dev/null
+	grep "^;" dig.out.ns3 > /dev/null
 	if test $? -ne 0 ; then break; fi
 	echo "I: plain zone re-transfer"
 	sleep 5
 done
 if test $tmp -eq 1 ; then status=1; fi
-grep ";" dig.out.ns3
+grep "^;" dig.out.ns3
 
 $PERL ../digcomp.pl dig.out.ns2 dig.out.ns3 || status=1
 
@@ -135,7 +135,7 @@ done
 
 $DIG $DIGOPTS example. \
 	@10.53.0.3 axfr -p 5300 > dig.out.ns3 || tmp=1
-grep ";" dig.out.ns3
+grep "^;" dig.out.ns3
 
 $PERL ../digcomp.pl dig2.good dig.out.ns3 || tmp=1
 
@@ -151,11 +151,11 @@ tmp=0
 
 $DIG $DIGOPTS master. \
 	@10.53.0.6 axfr -p 5300 > dig.out.ns6 || tmp=1
-grep ";" dig.out.ns6
+grep "^;" dig.out.ns6
 
 $DIG $DIGOPTS master. \
 	@10.53.0.3 axfr -p 5300 > dig.out.ns3 || tmp=1
-grep ";" dig.out.ns3 && cat dig.out.ns3
+grep "^;" dig.out.ns3 && cat dig.out.ns3
 
 $PERL ../digcomp.pl dig.out.ns6 dig.out.ns3 || tmp=1
 
@@ -171,11 +171,11 @@ tmp=0
 
 $DIG $DIGOPTS slave. \
 	@10.53.0.6 axfr -p 5300 > dig.out.ns6 || tmp=1
-grep ";" dig.out.ns6
+grep "^;" dig.out.ns6
 
 $DIG $DIGOPTS slave. \
 	@10.53.0.1 axfr -p 5300 > dig.out.ns1 || tmp=1
-grep ";" dig.out.ns1
+grep "^;" dig.out.ns1
 
 $PERL ../digcomp.pl dig.out.ns6 dig.out.ns1 || tmp=1
 
@@ -200,11 +200,11 @@ tmp=0
 
 $DIG $DIGOPTS slave. \
 	@10.53.0.1 axfr -p 5300 > dig.out.ns1 || tmp=1
-grep ";" dig.out.ns1
+grep "^;" dig.out.ns1
 
 $DIG $DIGOPTS slave. \
 	@10.53.0.7 axfr -p 5300 > dig.out.ns7 || tmp=1
-grep ";" dig.out.ns1
+grep "^;" dig.out.ns1
 
 $PERL ../digcomp.pl dig.out.ns7 dig.out.ns1 || tmp=1
 

lib/dns/rdata.c

@@ -116,7 +116,7 @@ typedef struct dns_rdata_textctx {
 } dns_rdata_textctx_t;
 
 static isc_result_t
-txt_totext(isc_region_t *source, isc_buffer_t *target);
+txt_totext(isc_region_t *source, isc_boolean_t quote, isc_buffer_t *target);
 
 static isc_result_t
 txt_fromtext(isc_textregion_t *source, isc_buffer_t *target);
@@ -125,13 +125,16 @@ static isc_result_t
 txt_fromwire(isc_buffer_t *source, isc_buffer_t *target);
 
 static isc_result_t
-multitxt_totext(isc_region_t *source, isc_buffer_t *target);
+multitxt_totext(isc_region_t *source, isc_buffer_t *target,
+		isc_boolean_t lenbyte);
 
 static isc_result_t
-multitxt_fromtext(isc_textregion_t *source, isc_buffer_t *target);
+multitxt_fromtext(isc_textregion_t *source, isc_buffer_t *target,
+		  isc_boolean_t lenbyte);
 
 static isc_result_t
-multitxt_fromwire(isc_buffer_t *source, isc_buffer_t *target);
+multitxt_fromwire(isc_buffer_t *source, isc_buffer_t *target,
+		  isc_boolean_t lenbyte);
 
 static isc_boolean_t
 name_prefix(dns_name_t *name, dns_name_t *origin, dns_name_t *target);
@@ -1131,7 +1134,7 @@ name_length(dns_name_t *name) {
 }
 
 static isc_result_t
-txt_totext(isc_region_t *source, isc_buffer_t *target) {
+txt_totext(isc_region_t *source, isc_boolean_t quote, isc_buffer_t *target) {
 	unsigned int tl;
 	unsigned int n;
 	unsigned char *sp;
@@ -1146,13 +1149,20 @@ txt_totext(isc_region_t *source, isc_buffer_t *target) {
 	n = *sp++;
 
 	REQUIRE(n + 1 <= source->length);
+	if (n == 0U)
+		REQUIRE(quote == ISC_TRUE);
 
-	if (tl < 1)
-		return (ISC_R_NOSPACE);
-	*tp++ = '"';
-	tl--;
+	if (quote) {
+		if (tl < 1)
+			return (ISC_R_NOSPACE);
+		*tp++ = '"';
+		tl--;
+	}
 	while (n--) {
-		if (*sp < 0x20 || *sp >= 0x7f) {
+		/*
+		 * \DDD space (0x20) if not quoting.
+		 */
+		if (*sp < (quote ? 0x20 : 0x21) || *sp >= 0x7f) {
 			if (tl < 4)
 				return (ISC_R_NOSPACE);
 			*tp++ = 0x5c;
@@ -1163,8 +1173,13 @@ txt_totext(isc_region_t *source, isc_buffer_t *target) {
 			tl -= 4;
 			continue;
 		}
-		/* double quote, semi-colon, backslash */
-		if (*sp == 0x22 || *sp == 0x3b || *sp == 0x5c) {
+		/*
+		 * Escape double quote, semi-colon, backslash.
+		 * If we are not enclosing the string in double
+		 * quotes also escape at sign.
+		 */
+		if (*sp == 0x22 || *sp == 0x3b || *sp == 0x5c ||
+		    (!quote && *sp == 0x40)) {
 			if (tl < 2)
 				return (ISC_R_NOSPACE);
 			*tp++ = '\\';
@@ -1175,10 +1190,12 @@ txt_totext(isc_region_t *source, isc_buffer_t *target) {
 		*tp++ = *sp++;
 		tl--;
 	}
-	if (tl < 1)
-		return (ISC_R_NOSPACE);
-	*tp++ = '"';
-	tl--;
+	if (quote) {
+		if (tl < 1)
+			return (ISC_R_NOSPACE);
+		*tp++ = '"';
+		tl--;
+	}
 	isc_buffer_add(target, (unsigned int)(tp - (char *)region.base));
 	isc_region_consume(source, *source->base + 1);
 	return (ISC_R_SUCCESS);
@@ -1274,8 +1291,17 @@ txt_fromwire(isc_buffer_t *source, isc_buffer_t *target) {
 	return (ISC_R_SUCCESS);
 }
 
+/*
+ * Conversion of TXT-like rdata fields without length limits.
+ * 'lenbyte' indicates whether to use length bytes in the encoding:
+ * The URI rdatatype uses length bytes for each 255-byte chunk of
+ * TXT, while the CAA rdatatype's length length is established by
+ * the overall rdata length. 
+ */
 static isc_result_t
-multitxt_totext(isc_region_t *source, isc_buffer_t *target) {
+multitxt_totext(isc_region_t *source, isc_buffer_t *target,
+		isc_boolean_t lenbyte)
+{
 	unsigned int tl;
 	unsigned int n0, n;
 	unsigned char *sp;
@@ -1292,9 +1318,13 @@ multitxt_totext(isc_region_t *source, isc_buffer_t *target) {
 	*tp++ = '"';
 	tl--;
 	do {
-		n0 = n = *sp++;
-
-		REQUIRE(n0 + 1 <= source->length);
+		if (lenbyte) {
+			n0 = n = *sp++;
+			REQUIRE(n0 + 1 <= source->length);
+		} else {
+			n = source->length;
+			n0 = source->length - 1;
+		}
 
 		while (n--) {
 			if (*sp < 0x20 || *sp >= 0x7f) {
@@ -1331,7 +1361,9 @@ multitxt_totext(isc_region_t *source, isc_buffer_t *target) {
 }
 
 static isc_result_t
-multitxt_fromtext(isc_textregion_t *source, isc_buffer_t *target) {
+multitxt_fromtext(isc_textregion_t *source, isc_buffer_t *target,
+		  isc_boolean_t lenbyte)
+{
 	isc_region_t tregion;
 	isc_boolean_t escape;
 	unsigned int n, nrem;
@@ -1346,17 +1378,21 @@ multitxt_fromtext(isc_textregion_t *source, isc_buffer_t *target) {
 
 	do {
 		isc_buffer_availableregion(target, &tregion);
-		t0 = tregion.base;
+		t0 = t = tregion.base;
 		nrem = tregion.length;
 		if (nrem < 1)
 			return (ISC_R_NOSPACE);
-		/* length byte */
-		t = t0;
-		nrem--;
-		t++;
-		/* 255 byte character-string slice */
-		if (nrem > 255)
-			nrem = 255;
+
+		if (lenbyte) {
+			/* length byte */
+			nrem--;
+			t++;
+
+			/* 255 byte character-string slice */
+			if (nrem > 255)
+				nrem = 255;
+		}
+
 		while (n != 0) {
 			--n;
 			c = (*s++) & 0xff;
@@ -1390,14 +1426,20 @@ multitxt_fromtext(isc_textregion_t *source, isc_buffer_t *target) {
 		}
 		if (escape)
 			return (DNS_R_SYNTAX);
-		*t0 = (unsigned char)(t - t0 - 1);
-		isc_buffer_add(target, *t0 + 1);
+
+		if (lenbyte) {
+			*t0 = (unsigned char)(t - t0 - 1);
+			isc_buffer_add(target, *t0 + 1);
+		} else
+			isc_buffer_add(target, t - t0);
 	} while (n != 0);
 	return (ISC_R_SUCCESS);
 }
 
 static isc_result_t
-multitxt_fromwire(isc_buffer_t *source, isc_buffer_t *target) {
+multitxt_fromwire(isc_buffer_t *source, isc_buffer_t *target,
+		  isc_boolean_t lenbyte)
+{
 	unsigned int n;
 	isc_region_t sregion;
 	isc_region_t tregion;
@@ -1409,9 +1451,12 @@ multitxt_fromwire(isc_buffer_t *source, isc_buffer_t *target) {
 	do {
 		if (n != 256U)
 			return (DNS_R_SYNTAX);
-		n = *sregion.base + 1;
-		if (n > sregion.length)
-			return (ISC_R_UNEXPECTEDEND);
+		if (lenbyte) {
+			n = *sregion.base + 1;
+			if (n > sregion.length)
+				return (ISC_R_UNEXPECTEDEND);
+		} else
+			n = sregion.length;
 
 		isc_buffer_availableregion(target, &tregion);
 		if (n > tregion.length)

lib/dns/rdata/generic/caa_257.c

+/*
+ * Copyright (C) 2014  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef GENERIC_CAA_257_C
+#define GENERIC_CAA_257_C 1
+
+#define RRTYPE_CAA_ATTRIBUTES (0)
+
+static unsigned char const alphanumeric[256] = {
+	/* 0x00-0x0f */ 0, 0, 0, 0, 0, 0, 0, 0,  0, 0, 0, 0, 0, 0, 0, 0,
+	/* 0x10-0x1f */ 0, 0, 0, 0, 0, 0, 0, 0,  0, 0, 0, 0, 0, 0, 0, 0,
+	/* 0x20-0x2f */ 0, 0, 0, 0, 0, 0, 0, 0,  0, 0, 0, 0, 0, 0, 0, 0,
+	/* 0x30-0x3f */ 1, 1, 1, 1, 1, 1, 1, 1,  1, 1, 0, 0, 0, 0, 0, 0,
+	/* 0x40-0x4f */ 0, 1, 1, 1, 1, 1, 1, 1,  1, 1, 1, 1, 1, 1, 1, 1,
+	/* 0x50-0x5f */ 1, 1, 1, 1, 1, 1, 1, 1,  1, 1, 1, 0, 0, 0, 0, 0,
+	/* 0x60-0x6f */ 0, 1, 1, 1, 1, 1, 1, 1,  1, 1, 1, 1, 1, 1, 1, 1,
+	/* 0x70-0x7f */ 1, 1, 1, 1, 1, 1, 1, 1,  1, 1, 1, 0, 0, 0, 0, 0,
+	/* 0x80-0x8f */ 0, 0, 0, 0, 0, 0, 0, 0,  0, 0, 0, 0, 0, 0, 0, 0,
+	/* 0x90-0x9f */ 0, 0, 0, 0, 0, 0, 0, 0,  0, 0, 0, 0, 0, 0, 0, 0,
+	/* 0xa0-0xaf */ 0, 0, 0, 0, 0, 0, 0, 0,  0, 0, 0, 0, 0, 0, 0, 0,
+	/* 0xb0-0xbf */ 0, 0, 0, 0, 0, 0, 0, 0,  0, 0, 0, 0, 0, 0, 0, 0,
+	/* 0xc0-0xcf */ 0, 0, 0, 0, 0, 0, 0, 0,  0, 0, 0, 0, 0, 0, 0, 0,
+	/* 0xd0-0xdf */ 0, 0, 0, 0, 0, 0, 0, 0,  0, 0, 0, 0, 0, 0, 0, 0,
+	/* 0xe0-0xef */ 0, 0, 0, 0, 0, 0, 0, 0,  0, 0, 0, 0, 0, 0, 0, 0,
+	/* 0xf0-0xff */ 0, 0, 0, 0, 0, 0, 0, 0,  0, 0, 0, 0, 0, 0, 0, 0,
+};
+
+static inline isc_result_t
+fromtext_caa(ARGS_FROMTEXT) {
+	isc_token_t token;
+	isc_textregion_t tr;
+	isc_uint8_t flags;
+	unsigned int i;
+
+	REQUIRE(type == 257);
+
+	UNUSED(type);
+	UNUSED(rdclass);
+	UNUSED(origin);
+	UNUSED(options);
+	UNUSED(callbacks);
+
+	/* Flags. */
+	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
+				      ISC_FALSE));
+	if (token.value.as_ulong > 255U)
+		RETTOK(ISC_R_RANGE);
+	flags = token.value.as_ulong;
+	RETERR(uint8_tobuffer(flags, target));
+
+	/*
+	 * Tag
+	 */
+	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string,
+				      ISC_FALSE));
+	tr = token.value.as_textregion;
+	for (i = 0; i < tr.length; i++)
+		if (!alphanumeric[(unsigned int) tr.base[i]])
+			RETTOK(DNS_R_SYNTAX);
+	RETERR(uint8_tobuffer(tr.length, target));
+	RETERR(mem_tobuffer(target, tr.base, tr.length));
+
+	/*
+	 * Value
+	 */
+	RETERR(isc_lex_getmastertoken(lexer, &token,
+				      isc_tokentype_qstring, ISC_FALSE));
+	if (token.type != isc_tokentype_qstring &&
+	    token.type != isc_tokentype_string)
+		RETERR(DNS_R_SYNTAX);
+	RETERR(multitxt_fromtext(&token.value.as_textregion, target,
+				 ISC_FALSE));
+	return (ISC_R_SUCCESS);
+}
+
+static inline isc_result_t
+totext_caa(ARGS_TOTEXT) {
+	isc_region_t region;
+	isc_uint8_t flags;
+	char buf[256];
+
+	UNUSED(tctx);
+
+	REQUIRE(rdata->type == 257);
+	REQUIRE(rdata->length >= 3U);
+	REQUIRE(rdata->data != NULL);
+
+	dns_rdata_toregion(rdata, &region);
+
+	/*
+	 * Flags
+	 */
+	flags = uint8_consume_fromregion(&region);
+	sprintf(buf, "%u ", flags);
+	RETERR(str_totext(buf, target));
+
+	/*
+	 * Tag
+	 */
+	RETERR(txt_totext(&region, ISC_FALSE, target));
+	RETERR(str_totext(" ", target));
+
+	/*
+	 * Value
+	 */
+	RETERR(multitxt_totext(&region, target, ISC_FALSE));
+	return (ISC_R_SUCCESS);
+}
+
+static inline isc_result_t
+fromwire_caa(ARGS_FROMWIRE) {
+	isc_region_t sr;
+	unsigned int len, i;
+
+	REQUIRE(type == 257);
+
+	UNUSED(type);
+	UNUSED(rdclass);
+	UNUSED(dctx);
+	UNUSED(options);
+
+	/*
+	 * Flags
+	 */
+	isc_buffer_activeregion(source, &sr);
+	if (sr.length < 2)
+		return (ISC_R_UNEXPECTEDEND);
+
+	/*
+	 * Flags, tag length
+	 */
+	RETERR(mem_tobuffer(target, sr.base, 2));
+	len = sr.base[1];
+	isc_region_consume(&sr, 2);
+	isc_buffer_forward(source, 2);
+
+	/*
+	 * Zero length tag fields are illegal.
+	 */
+	if (sr.length < len || len == 0)
+		RETERR(DNS_R_FORMERR);
+
+	/* Tag */
+	for (i = 0; i < sr.length; i++)
+		if (!alphanumeric[sr.base[i]])
+			RETERR(DNS_R_FORMERR);
+	RETERR(mem_tobuffer(target, sr.base, len));
+	isc_region_consume(&sr, len);
+	isc_buffer_forward(source, len);
+
+	/*
+	 * Value
+	 */
+	RETERR(multitxt_fromwire(source, target, ISC_FALSE));
+
+	return (ISC_R_SUCCESS);
+}
+
+static inline isc_result_t
+towire_caa(ARGS_TOWIRE) {
+	isc_region_t region;
+
+	REQUIRE(rdata->type == 257);
+	REQUIRE(rdata->length >= 3U);
+	REQUIRE(rdata->data != NULL);
+
+	UNUSED(cctx);
+
+	dns_rdata_toregion(rdata, &region);
+	return (mem_tobuffer(target, region.base, region.length));
+}
+
+static inline int
+compare_caa(ARGS_COMPARE) {
+	isc_region_t r1, r2;
+
+	REQUIRE(rdata1->type == rdata2->type);
+	REQUIRE(rdata1->rdclass == rdata2->rdclass);
+	REQUIRE(rdata1->type == 257);
+	REQUIRE(rdata1->length >= 3U);
+	REQUIRE(rdata2->length >= 3U);
+	REQUIRE(rdata1->data != NULL);
+	REQUIRE(rdata2->data != NULL);
+
+	dns_rdata_toregion(rdata1, &r1);
+	dns_rdata_toregion(rdata2, &r2);
+	return (isc_region_compare(&r1, &r2));
+}
+
+static inline isc_result_t
+fromstruct_caa(ARGS_FROMSTRUCT) {
+	dns_rdata_caa_t *caa = source;
+	isc_region_t region;
+	unsigned int i;
+
+	REQUIRE(type == 257);
+	REQUIRE(source != NULL);
+	REQUIRE(caa->common.rdtype == type);
+	REQUIRE(caa->common.rdclass == rdclass);
+	REQUIRE(caa->tag != NULL && caa->tag_len != 0);
+	REQUIRE(caa->value != NULL);
+
+	UNUSED(type);
+	UNUSED(rdclass);
+
+	/*
+	 * Flags
+	 */
+	RETERR(uint8_tobuffer(caa->flags, target));
+
+	/*