[ZOOKEEPER-3860] Avoid reverse DNS lookup for hostname verification when hostnames are provided in the connection url

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.5.7
• Fix Version/s: 3.9.0, 3.8.2
• Component/s: security
• Labels: pull-request-available
• Assignee: Andor Molnar
• Reporter: Ravi Bhardwaj
• Created: 12/Jun/20 00:49
• Updated: 04/Aug/23 11:28
• Resolved: 14/Jun/23 13:00

Description

The current implementation of ZKTrustManager [1], zookeeper tries to verify hostname using the IP first and then performs a reverse DNS lookup.

This could be a problem when IP address can not be resolved to the hostname added in DN/SAN.

The functionality can be improved by matching the hostname provided in the connection url against DN/SAN. It that can not be matched, try to match the IP address. If that fails then perform a reverse DNS lookup.

An alternative approach could to match the only hostname against DN/SAN when hostname is provided in the connection url.

If IP address is provided, then check with the IP address first. If that fails, perform a reverse DNS lookup and match the hostname returned against DN/SAN.

 

[1] https://zookeeper.apache.org/doc/r3.5.7/apidocs/zookeeper-server/org/apache/zookeeper/common/ZKTrustManager.html

Issue Links

• links to: GitHub Pull Request #2005