Uploaded image for project: 'ZooKeeper'
  1. ZooKeeper
  2. ZOOKEEPER-3860

Avoid reverse DNS lookup for hostname verification when hostnames are provided in the connection url

    XMLWordPrintableJSON

Details

    Description

      The current implementation of ZKTrustManager [1], zookeeper tries to verify hostname using the IP first and then performs a reverse DNS lookup.

      This could be a problem when IP address can not be resolved to the hostname added in DN/SAN.

      The functionality can be improved by matching the hostname provided in the connection url against DN/SAN. It that can not be matched, try to match the IP address. If that fails then perform a reverse DNS lookup.

      An alternative approach could to match the only hostname against DN/SAN when hostname is provided in the connection url.

      If IP address is provided, then check with the IP address first. If that fails, perform a reverse DNS lookup and match the hostname returned against DN/SAN.

       

      [1] https://zookeeper.apache.org/doc/r3.5.7/apidocs/zookeeper-server/org/apache/zookeeper/common/ZKTrustManager.html

      Attachments

        Issue Links

          Activity

            People

              andor Andor Molnar
              ravi.bhardwaj Ravi Bhardwaj
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0h
                  0h
                  Logged:
                  Time Spent - 40m
                  40m