Implement DNS hostname canonicalization #50
Conversation
steelman
force-pushed
the
dns-canonicalize-hostname
branch
from
dfbc8d5 to
47aee87
Compare
|
Ping? |
|
The reason why SSPI does not implement it is that it is unsafe, and can lead to MITM scenarios, especially with protocols like NTLMSSP. I am not entirely sure we should provide this functionality from request-gssapi, because it is bound to be used without understanding opening up users of the application to bad surprises later. I think at the very least these should not be common options provided in the function signature, and instead accessors you need to explicitly find and set individually after the HTTPSPNEGOAuth object has been instantiated. ie: This will discourage casual setting and each of the effects can be documented in a doc string for the accessor. The doc string MUST contain warnings that describe why these options are BAD ideas, and point to the relvant security sections of the RFC for a full description. |
steelman
force-pushed
the
dns-canonicalize-hostname
branch
from
47aee87 to
e526fb5
Compare
|
This pull request is stale because it has been open for 4 weeks with no activity. Remove stale label or comment or this will be closed in 2 weeks. |
|
Ping? |
steelman
force-pushed
the
dns-canonicalize-hostname
branch
2 times, most recently
from
19ddfc7 to
35cf9e6
Compare
Optionally resolve hostname via CNAME recrord to its canonical form (A or AAAA record). Optionally use reverse DNS query. Such code is necessary on Windows platforms where SSPI (unlike MIT Kerberos[1]) does not implement such operation and it is applications' responsibility[2] to take care of CNAME resolution. However, the code seems universal enough to put it into the library rather than in every single program using requests_gssapi. Warning: Usage of insecure DNS queries is explicitly forbidden in RFC 4120[3] and may result in the risk of man-in-the-middle attack. [1] https://github.com/krb5/krb5/blob/ec71ac1cabbb3926f8ffaf71e1ad007e4e56e0e5/src/lib/krb5/os/sn2princ.c#L99 [2] https://learn.microsoft.com/en-us/previous-versions/office/sharepoint-server-2010/gg502606(v=office.14)?redirectedfrom=MSDN#kerberos-authentication-and-dns-cnames [3] https://datatracker.ietf.org/doc/html/rfc4120 Signed-off-by: Łukasz Stelmach <[email protected]>
steelman
force-pushed
the
dns-canonicalize-hostname
branch
from
35cf9e6 to
8f9116d
Compare
2 participants
Optionally resolve hostname via CNAME recrord to its canonical form (A or AAAA record). Optionally use reverse DNS query.
Such code is necessary on Windows platforms where SSPI (unlike MIT Kerberos[1]) does not implement such operation and it is applications' responsibility[2] to take care of CNAME resolution. However, the code seems universal enough to put it into the library rather than in every single program using requests_gssapi.
[1] https://github.com/krb5/krb5/blob/ec71ac1cabbb3926f8ffaf71e1ad007e4e56e0e5/src/lib/krb5/os/sn2princ.c#L99
[2] https://learn.microsoft.com/en-us/previous-versions/office/sharepoint-server-2010/gg502606(v=office.14)?redirectedfrom=MSDN#kerberos-authentication-and-dns-cnames