Merge branch 'main' into multiplat

Author: sheurich

va/caa.go

@@ -202,11 +202,11 @@ func filterCAA(rrs []*dns.CAA) ([]*dns.CAA, []*dns.CAA, bool) {
 			// do not store the contents of the property tag, but also avoid setting
 			// the criticalUnknown bit if there are critical iodef tags.
 			continue
-		case "issuemail":
-			// We support the issuemail property tag insofar as we recognize it and
-			// therefore do not bail out if someone has a critical issuemail tag. But
+		case "issuemail", "issuevmc":
+			// We support these property tags insofar as we recognize them and
+			// therefore do not bail out if someone has one marked critical. But
 			// of course we do not do any further processing, as we do not issue
-			// S/MIME certificates.
+			// S/MIME or VMC certificates.
 			continue
 		default:
 			// The critical flag is the bit with significance 128. However, many CAA

va/caa_test.go

@@ -1163,6 +1163,7 @@ func TestFilterCAA(t *testing.T) {
 				{Tag: "issuewild", Value: "b"},
 				{Tag: "iodef", Value: "c"},
 				{Tag: "issuemail", Value: "c"},
+				{Tag: "issuevmc", Value: "c"},
 			},
 			expectedIssueVals: []string{"a"},
 			expectedWildVals:  []string{"b"},
@@ -1174,6 +1175,7 @@ func TestFilterCAA(t *testing.T) {
 				{Tag: "issuewild", Value: "b", Flag: 128},
 				{Tag: "iodef", Value: "c", Flag: 128},
 				{Tag: "issuemail", Value: "c", Flag: 128},
+				{Tag: "issuevmc", Value: "c", Flag: 128},
 			},
 			expectedIssueVals: []string{"a"},
 			expectedWildVals:  []string{"b"},