[16021] in Kerberos-V5-bugs
[krbdev.mit.edu #8687] Repeated lookups of local computer name on
daemon@ATHENA.MIT.EDU (Greg Hudson via RT)
Sun May 27 00:00:53 2018
Mail-followup-to: rt@krbdev.mit.edu
mail-copies-to: never
From: "Greg Hudson via RT" <rt-comment@KRBDEV-PROD-APP-1.mit.edu>
In-Reply-To: <rt-8687@krbdev.mit.edu>
Message-ID: <rt-8687-48569.18.842155303736@krbdev.mit.edu>
To: "'AdminCc of krbdev.mit.edu Ticket #8687'":;
Date: Sun, 27 May 2018 00:00:46 -0400 (EDT)
Reply-To: rt-comment@KRBDEV-PROD-APP-1.mit.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krb5-bugs-bounces@mit.edu
Every time we want to look up a SRV or URI record, we call
krb5int_dns_init(), which calls res_init() (absent res_ninit()
support or being on a Mac). On Windows this is implemented via the
wshelper library. The wshelper res_init() initializes a global
structure _res, but does not check if _res is already initialized (as
it could via _res.options & RES_INIT).
As part of its work, it tries to determine a local domain name and
search path. Unless the LOCALDOMAIN environment variable is set, it
does this by calling GetComputerName() and looking up the result in
DNS with DnsQuery_A() with the DNS_QUERY_BYPASS_CACHE and
DNS_QUERY_NO_LOCAL_NAME flags. On a VM I set up using Windows 10,
this lookup takes approximately one second to fail (I'm not sure
why), causing kinit to take several seconds in a typical exchange.
We do not currently make use of the local domain or search path in
the resolver configuration, since we always look up absolute domain
names (dnssrv.c:prepare_lookup_buf()). We have some interest in a
local domain name to expand short names when
dns_canonicalize_hostname is set to false, but it would need to be
determined from on-machine configuration, not DNS.
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
https://mailman.mit.edu/mailman/listinfo/krb5-bugs
