Uploaded image for project: 'Mesos'
  1. Mesos
  2. MESOS-9811

Don't use reverse DNS for hostname validation

    XMLWordPrintableJSON

Details

    • Bug
    • Status: Resolved
    • Major
    • Resolution: Fixed
    • None
    • 1.9.0
    • None
    • Mesos Foundations: RI15 Sp 48, Mesos Foundations: RI 15 Sp 49, Mesos Foundations: RI-16 Sp 50
    • 5

    Description

      Upon connection we first resolve the hostname and forget about it

      https://github.com/apache/mesos/blob/master/3rdparty/libprocess/src/http.cpp#L1462-L1504

      then later use reverse DNS on the remote address to get back a hostname

      https://github.com/apache/mesos/blob/4708c2a368e12a89669135f47777d0dd05d9b0b2/3rdparty/libprocess/src/posix/libevent/libevent_ssl_socket.cpp#L548-L556

      and verify the server certificate against that.

      Instead, we should verify the server certificate against the hostname that was used by t he client to initiate the connection.

      Attachments

        Activity

          People

            bennoe Benno Evers
            bennoe Benno Evers
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: