summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorRob Crittenden <rcritten@redhat.com>2011-08-26 10:42:40 -0400
committerRob Crittenden <rcritten@redhat.com>2011-08-25 20:43:33 -0400
commitaad2aecb34b723cd322f46ea4aa7c349e9f5f465 (patch)
treedb7f072ebd76304900ac2c31558ae93ba37b0828
parentfc898bc607b065c38d177cfb5db771b7549a7f3f (diff)
downloadfreeipa-aad2aecb34b723cd322f46ea4aa7c349e9f5f465.zip
freeipa-aad2aecb34b723cd322f46ea4aa7c349e9f5f465.tar.gz
freeipa-aad2aecb34b723cd322f46ea4aa7c349e9f5f465.tar.xz
Disable reverse lookups in ipa-join and ipa-getkeytab
This prevents broken DNS from causing enrollment problems. https://fedorahosted.org/freeipa/ticket/1693
-rw-r--r--ipa-client/ipa-getkeytab.c7
-rw-r--r--ipa-client/ipa-join.c7
2 files changed, 14 insertions, 0 deletions
diff --git a/ipa-client/ipa-getkeytab.c b/ipa-client/ipa-getkeytab.c
index 01b8d7b..b884e8d 100644
--- a/ipa-client/ipa-getkeytab.c
+++ b/ipa-client/ipa-getkeytab.c
@@ -577,6 +577,13 @@ static int ldap_set_keytab(krb5_context krbctx,
goto error_out;
}
+ /* Don't do DNS canonicalization */
+ ret = ldap_set_option(ld, LDAP_OPT_X_SASL_NOCANON, LDAP_OPT_ON);
+ if (ret != LDAP_SUCCESS) {
+ fprintf(stderr, _("Unable to set LDAP_OPT_X_SASL_NOCANON\n"));
+ goto error_out;
+ }
+
version = LDAP_VERSION3;
ret = ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &version);
if (ret != LDAP_SUCCESS) {
diff --git a/ipa-client/ipa-join.c b/ipa-client/ipa-join.c
index f6ca693..aac8097 100644
--- a/ipa-client/ipa-join.c
+++ b/ipa-client/ipa-join.c
@@ -213,6 +213,13 @@ connect_ldap(const char *hostname, const char *binddn, const char *bindpw) {
goto fail;
}
+ /* Don't do DNS canonicalization */
+ ret = ldap_set_option(ld, LDAP_OPT_X_SASL_NOCANON, LDAP_OPT_ON);
+ if (ret != LDAP_SUCCESS) {
+ fprintf(stderr, _("Unable to set LDAP_OPT_X_SASL_NOCANON\n"));
+ goto fail;
+ }
+
ret = ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &version);
if (ret != LDAP_SUCCESS) {
fprintf(stderr, _("Unable to set LDAP version\n"));