Support for rfc6764 - find CalDAV URL through DNS lookup

[tobixen]

It may be relevant to support RFC6764.

[tobixen]

#463 is related

[tobixen]

It took me five and a half years to get time to look into this, and it took Claude some few minutes to churn out an implementation that looks good to me. Hm. I'm concerned that we'll be very unemployed all of us quite soon.

(Well, I expect to still spend some days fighting with getting the functional tests pass at as many server implementations and systems as possible)

[tobixen]

I hope to merge this feature to the main branch this week, and release version 2.2 this year.

It seems like RFC6764 is much more wide-spread than I thought it would be, so this should definitively have been put in place at least four years ago.

Then again, I do see a major security flaw with the RFC6764 discovery. If the DNS is not to be trusted, someone can highjack the connection by spoofing the service records, and also spoofing the TLS setting, encouraging the client to connect over plain-text HTTP without certificate validation. Utilizing this it may be possible to steal the credentials. This flaw can be mitigated by using DNSSEC, but DNSSEC is not widely used, and there is currently no mechanisms in this package to verify that the DNS is secure.

The AI suggested to add a require_tls parameter that defaults to True, it will at least make it a bit more secure.