(ITS#8870) SASL_NOCANON changing default to ON

[alexandr.nedvedicky@oracle.com]

Full_Name: Alexandr Nedvedicky
Version: 2.46
OS: Solaris 11.3
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (141.143.193.76)


Disclaimer: I understand I'm asking for change, which might be disruptive for
many OpenLDAP users.

The issue popped up as a fallout of transition from Mozilla LDAP to OpenLDAP.
The mozilla ldap does not canonicalize hostname using DNS by default, while
OpenLDAP
does the exact opposite. Using DNS to canonicalize hosts to domain name opens
potential attack vector via. DNS spoofing.

For example samba client opts out from name canonicalization,
snippet comes from lib/libsmbns/common/smbns_ads.c:
1539  /*
1540   * smb_ads_open
1541   *
1542   * Open an LDAP connection to a discovered AD server for the specified
domain.
1543   * Specify our capability to support LDAP_VERSION3 when binding to the AD
1544   * server. On success, returns an AD handle. Otherwise, returns NULL.
1545   *
1546   * By default, 'encrypt_ldap' property is set to B_TRUE. For debugging
1547   * purposes, it can be set to B_FALSE to disable LDAP encryption.
1548   *
1549   * Pre-condition:
1550   *   A Kerberos TGT ticket must be found in ccache in order to acquire a
LDAP
1551   *   service ticket.
1552   *
1553   * Parameters:
1554   *   domain - fully-qualified domain name
1555   */
1556  static smb_ads_handle_t *
1557  smb_ads_open(char *domain)
1558  {
....
1590  		(void) ldap_unbind(ld);
1591  		return (NULL);
1592  	}
1593  
1594  	(void) ldap_set_option(ld, LDAP_OPT_REFERRALS, LDAP_OPT_OFF);
1595  	(void) ldap_set_option(ld, LDAP_OPT_X_SASL_NOCANON, LDAP_OPT_ON);
1596  
1597  	ah->ld = ld;
1598  	ah->domain = strdup(domain);
1599  
1600  	if (ah->domain == NULL) {
1601  		smb_ads_close(ah);
1602  		smb_ads_free_host(ads_host);
1603  		return (NULL);
1604  	}
1605  

I can't tell how other projects are handling/prefer handling of NOCANON
option. The Solaris considers to tight the knob and say 'yes to NOCANON'
in order to suppress hostname canonicalization.

As I've said I fully understand if you decide not to change the current
default as the change might hurt many users. I just rather want to share
our experience we got when switching from mozilla ldap to OpenLDAP.