#

# Force DNS name resolution when canonicalizing hostbased principal names.

#

# This patch is to preserve old standing Solaris Kerberos behavior,

# where hostbased principal names are canonicalized exclusively using DNS

# lookups. NIS has been known to cause issues with hostname canonicalization.

#

# This patch is not meant for upstream contribution.

# Patch source: in-house

#

--- a/src/lib/krb5/os/sn2princ.c

+++ b/src/lib/krb5/os/sn2princ.c

@@ -39,6 +39,14 @@

#define DEFAULT_RDNS_LOOKUP 1

#endif

+/*

+ * The following prototypes are needed because these are

+ * private interfaces that do not have prototypes in any .h

+ */

+extern struct hostent *res_getipnodebyname(const char *, int, int, int *);

+extern struct hostent *res_getipnodebyaddr(const void *, size_t, int, int *);

+extern void res_freehostent(struct hostent *);

+

static krb5_boolean

use_reverse_dns(krb5_context context)

{

@@ -53,6 +61,26 @@ use_reverse_dns(krb5_context context)

return value;

}

+/*

+ * Translate getipnodeby* error codes to strings for coherent error messaging.

+ */

+static const char *

+get_host_error(int err)

+{

+ switch(err) {

+ case HOST_NOT_FOUND:

+ return "host not found";

+ case NO_DATA:

+ return "no data record of requested type";

+ case NO_RECOVERY:

+ return "non-recoverable error";

+ case TRY_AGAIN:

+ return "host name lookup failure";

+ default:

+ return "error unknown";

+ }

+}

+

/* Set *name_out to the canonicalized form of name, obeying relevant

* configuration settings. The caller must free the result. */

static krb5_error_code

@@ -63,11 +91,15 @@ canon_hostname(krb5_context context, krb5_int32 type, const char *host,

char namebuf[NI_MAXHOST], *copy, *p;

int err;

const char *canonhost;

+ struct hostent *hp = NULL;

+ struct hostent *hp2 = NULL;

+ int addr_family;

*canonhost_out = NULL;

canonhost = host;

if (type == KRB5_NT_SRV_HST && context->dns_canonicalize_hostname) {

+#if 0

/* Try a forward lookup of the hostname. */

memset(&hint, 0, sizeof(hint));

hint.ai_flags = AI_CANONNAME;

@@ -86,6 +118,31 @@ canon_hostname(krb5_context context, krb5_int32 type, const char *host,

if (!err)

canonhost = namebuf;

}

+#endif

+ /* using res_getipnodebyname to force dns name resolution*/

+ addr_family = AF_INET;

+try_getipnodebyname_again:

+ hp = res_getipnodebyname(host, addr_family, 0, &err);

+ if (hp == NULL) {

+ if (addr_family == AF_INET) {

+ /* Just in case it's an IPv6-only name. */

+ addr_family = AF_INET6;

+ goto try_getipnodebyname_again;

+ }

+ k5_setmsg(context, KRB5_ERR_BAD_HOSTNAME,

+ _("Hostname cannot be canonicalized for '%s': %s"),

+ host, get_host_error(err));

+ return KRB5_ERR_BAD_HOSTNAME;

+ }

+ canonhost = hp->h_name;

+

+ if (use_reverse_dns(context)) {

+ /* Try a reverse lookup of the address. */

+ hp2 = res_getipnodebyaddr(hp->h_addr, hp->h_length,

+ hp->h_addrtype, &err);

+ if (hp2 != NULL)

+ canonhost = hp2->h_name;

+ }

}

copy = strdup(canonhost);

@@ -110,9 +167,12 @@ canon_hostname(krb5_context context, krb5_int32 type, const char *host,

*canonhost_out = copy;

cleanup:

- /* We only return success or ENOMEM. */

if (ai != NULL)

freeaddrinfo(ai);

+ if (hp != NULL)

+ res_freehostent(hp);

+ if (hp2 != NULL)

+ res_freehostent(hp2);

return (*canonhost_out == NULL) ? ENOMEM : 0;

}

--- a/src/util/k5test.py

+++ b/src/util/k5test.py

@@ -364,6 +364,7 @@ import string

import subprocess

import sys

import imp

+import re

# Used when most things go wrong (other than programming errors) so

# that the user sees an error message rather than a Python traceback,

@@ -485,7 +486,19 @@ def _find_srctop():

# because it explicitly prefers results containing periods and

# krb5_sname_to_principal doesn't care.

def _get_hostname():

+ # in Solaris, we always canonicalize using FQDN by forcing DNS lookup

hostname = socket.gethostname()

+ # dig for fqdn, only output answer section

+ answer = subprocess.check_output(['/usr/sbin/dig', '+search', '+noall', '+answer', hostname]);

+ for line in answer.split("\n"):

+ # find A record

+ if re.search(r"\bA\b", line):

+ # only cut out the NAME part

+ return re.sub(r'\.?[ \t].*','',line)

+

+ fail('Local hostname "%s" does not resolve: %s.' % (hostname, errstr))

+

+ # unreachable:

try:

ai = socket.getaddrinfo(hostname, None, 0, 0, 0, socket.AI_CANONNAME)

except socket.gaierror, (error, errstr):