[23249] in Kerberos
Re: Kerberos authentication without reverse lookup
daemon@ATHENA.MIT.EDU (Ken Raeburn)
Mon Jan 24 17:14:05 2005
In-Reply-To: <donn-F15618.09444419012005@gnus01.u.washington.edu>
Mime-Version: 1.0 (Apple Message framework v619)
Content-Type: text/plain; charset=US-ASCII; format=flowed
Message-Id: <24090786-6E55-11D9-8F82-000A95909EE2@mit.edu>
Content-Transfer-Encoding: 7bit
From: Ken Raeburn <raeburn@mit.edu>
Date: Mon, 24 Jan 2005 17:13:13 -0500
To: Donn Cave <donn@u.washington.edu>
cc: Ken Raeburn <raeburn@mit.edu>
cc: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
On Jan 19, 2005, at 12:44, Donn Cave wrote:
>> I'm sorry if I'm wrong, but doesn't getaddrinfo get ai_canonname by
>> doing a reverse lookup? When I tried it out, at least that is what
>> happened.
>
> It depends on the platform. The GNU getaddrinfo implementation
> does. I'm assuming AI_CANONNAME in ai_flags.
Yeah, the GNU one is just broken that way.
> NetBSD 2.0, AIX 5.2 don't, they stop at what you'd get from
> gethostbyname() -- they look up CNAME aliases but don't
> look up the IP PTR.
Yes, I think they're closer (at least) to getting it right.
Maybe not quite there... the NetBSD one didn't look thread-safe at a
glance, though I may have missed something, and thread safety is part
of the spec of the function. I don't have AIX 5.2 to test with, but
4.3.3 had some issues we had to work around, too.
> Also might be worth mentioning that the MIT implementation
> also uses this in several places, though in the critical
> sname_to_principal() function it uses getnameinfo for the
> lookup.
>
> Secure DNS would be nice for all this.
Yup, we've got problems to address in this area. Can't do it for 1.4,
though.
Ken
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
