[python-ldap] Validated URL can't be used for bind - handling SRV lookups

[Elias Probst]

On 16.10.2013 09:25, Michael Ströder wrote:
> Elias Probst wrote:
>> I planned to make it possible to use URLs like this:
>> ldap:///dc=company,dc=tld
> You should seriously consider the security implications regarding DNS spoofing
> by relying on yet another DNS lookup which is *not* protected by e.g. TLS
> hostname check.
So is the first lookup. Either I use DNSSEC/only IPs or any of my DNS
queries could be forged.
> […]
>> This seems to happen, because python-ldap doesn't use dn2domain() and
>> domain2hostlist() from libldap. See also the following IRC log where
>> OpenLDAP dev 'hyc' pointed me towards this:
> So what do you expect python-ldap to do?
I expected python-ldap to handle such URLs just like 'ldapsearch' does
without any additional implementation to handle SRV lookups manually.
> Mainly you have to implement that yourself by using one of the DNS modules for
> Python (like I did in web2ldap). It's not a big deal anyway.
Just looked briefly at the code and it seems to be rather
straightforward. I'll have to re-implement it (instead of copying)
though, as the GPLv2 isn't compatible with the Apache License used by Salt.
> But again: Think twice considering security aspects.
Yes, I'll surely do. Maybe I'll add some warnings in case SRV is used to
the log output. In my use case, I'm fine with using it this way.
> Ciao, Michael.
Thanks a lot for the input!

Elias P.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 263 bytes
Desc: OpenPGP digital signature
URL: <http://mail.python.org/pipermail/python-ldap/attachments/20131016/5ba120f3/attachment.sig>