Re: [linux-cifs-client] [PATCH] cifs.upcall: make using ip address conditional on new option
Jeff Layton <[email protected]>
| Newsgroups | gmane.network.samba.internals,gmane.linux.file-systems.cifs |
|---|---|
| Message-ID | <[email protected]> |
On Wed, 19 Aug 2009 13:30:37 -0400 Jeff Layton <[email protected]> wrote: > Igor Mammedov pointed out that reverse resolving an IP address to get > the hostname portion of a principal could open a possible attack > vector. If an attacker were to gain control of DNS, then he could > redirect the mount to a server of his choosing, and fix the reverse > resolution to point to a hostname of his choosing (one where he has > the key for the corresponding cifs/ or host/ principal). > > That said, we often trust DNS for other reasons and it can be useful > to do so. Make the code that allows trusting DNS to be enabled by > adding --trust-dns to the cifs.upcall invocation. > > Signed-off-by: Jeff Layton <[email protected]> > --- > client/cifs.upcall.c | 62 ++++++++++++++++++++++++++++++++----------------- > 1 files changed, 40 insertions(+), 22 deletions(-) > Pushed to samba master branch (along with a corresponding manpage update). -- Jeff Layton <[email protected]>