Configurable DNS domain validation for SRV records

XMLWordPrintableJSON

    • Type: Task
    • Resolution: Fixed
    • Priority: Critical - P2
    • 4.18.0
    • Affects Version/s: None
    • Component/s: None
    • Hide

      DRIVERS-3329:
      Summary of necessary driver changes

      • add support for `srvAllowedHostsSuffix` – drivers will need to utilize the public suffix list as a deny list as a safeguard
      • add docs explaining the use of this parameter (and its potential security implications when used)

      Commits for syncing spec/prose tests
      (and/or refer to an existing language POC if needed)

      Context for other referenced/linked tickets

      Show
      DRIVERS-3329 : Summary of necessary driver changes add support for `srvAllowedHostsSuffix` – drivers will need to utilize the public suffix list as a deny list as a safeguard add docs explaining the use of this parameter (and its potential security implications when used) Commits for syncing spec/prose tests (and/or refer to an existing language POC if needed) https://github.com/mongodb/specifications/commit/6f64d0ee3ae49edbdb30eb995f3e29549e8cfa6a (also defines how to use and parse the public suffix list) Context for other referenced/linked tickets https://jira.mongodb.org/browse/DRIVERS-3568
    • None
    • Python Drivers
    • Needed
    • Hide

      1. What would you like to communicate to the user about this feature? 
      There is a new parameter,`srvAllowedHostsSuffix`! We should also clearly communicate the security risks that come with using this parameter.
      2. Would you like the user to see examples of the syntax and/or executable code and its output?
      yes a snippet of sample code would be nice – see changelog and docstring in this commit for examples. 
      3. Which versions of the driver/connector does this apply to?
      pymongo 4.18+

      Show
      1. What would you like to communicate to the user about this feature?  There is a new parameter,`srvAllowedHostsSuffix`! We should also clearly communicate the security risks that come with using this parameter. 2. Would you like the user to see examples of the syntax and/or executable code and its output? yes a snippet of sample code would be nice – see changelog and docstring in this commit for examples.  3. Which versions of the driver/connector does this apply to? pymongo 4.18+
    • None
    • None
    • None
    • None
    • None
    • None

      According to the Initial DNS Seedlist Discovery specification, "A driver MUST verify that the host names returned through SRV records share the original SRV's domainname. In addition, SRV records with fewer than three . separated parts, the returned hostname MUST have at least one more domain level than the SRV record hostname. Drivers MUST raise an error and MUST NOT initiate a connection to any returned hostname which does not fulfill these requirements."

      The parsing logic however assumes that the left-most part of a URL (period-separated) is the subdomain, and everything to the right of that is the domain. This can result in user-managed DNS records that should be valid being considered invalid.

      For example, if a DNS record of _mongodb._tcp.mongodb.mydomain.net contained regionally separated URLs in the form of:

      • mongodb1.us-east-1.mydomain.net
      • mongodb2.us-east-1.mydomain.net
      • mongodb3.us-west-1.mydomain.net

      this would be considered invalid.

            Assignee:
            Iris Ho
            Reporter:
            Jib Adegunloye
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved: