Re: BUG #5559: Full SSL verification fails when hostaddr provided

Stephen Frost <sfrost(at)snowman(dot)net> writes:
> krb5_sname_to_principal() will use the passed hostname for the second
> component. If type is KRB5_NT_SRV_HST this name will be looked up with
> gethostbyname(). If hostname is NULL, the local hostname will be used.

> If we were passing in NULL before when hostaddr was set and host wasn't,
> then we were probably ending up with Kerberos trying to use the local
> hostname, which almost certainly wasn't right.

Ah. I agree that that would be unexpected behavior.

> I expect that the
> correct answer here would be to do whatever the actual connection logic
> does- if it connects using host, then use host, if it connects using
> hostaddr, then use hostaddr.

Uh, no, because hostaddr is (required to be) a numeric IP. The odds of
it being useful in this context seem negligible.

At this point I'm satisfied that what the code is doing is right. We
can't authenticate against Kerberos without knowing the server host
name, because we can't form a correct principal name. Whether use of
hostaddr would avoid an rDNS lookup inside the library is not relevant.

regards, tom lane