URL:
https://github.com/SSSD/sssd/pull/5268
Title: #5268: (WiP) proxy_child hardening
alexey-tikhonov commented:
"""
I will keep "changes requested" label to:
...
* investigate if DNS impose more strict reqs on the domain name
than what is currently stated in the man page (thank @sumit-bose for the hint)
This is tricky.
https://tools.ietf.org/html/rfc1034#section-3.5 "Preferred name syntax"
https://tools.ietf.org/html/rfc1123#section-2.1 "Host Names and Numbers"
https://tools.ietf.org/html/rfc2181#section-11 "Name syntax"
If I read those ^^ docs correctly, conclusion is very much like:
```
The characters allowed in labels are a subset of the ASCII character set, consisting of
characters a through z,
A through Z, digits 0 through 9, and hyphen. This rule is known as the LDH rule (letters,
digits, hyphen).
Domain names are interpreted in case-independent manner. Labels may not start or end with
a hyphen.
```
This means 2 additional restrictions to the current statement in SSSD man page:
1) no "underscores"
2) labels may not start or end with a hyphen
(and also `dash` in the man page should be replaced with `hyphen`)
I think (2) is fine, but I'm somewhat worried with (1) - this probably might break
existing configs.
@sumit-bose , what would you think?
"""
See the full comment at
https://github.com/SSSD/sssd/pull/5268#issuecomment-764848735