... btw, the libpq documentation claims that
If hostaddr is specified without host, the value for hostaddr
gives the remote address. When Kerberos is used, a reverse name
query occurs to obtain the host name for Kerberos.
but so far as I can see this is flat wrong. pg_krb5_sendauth throws
an error if you didn't provide a host name, and so do the other places
in fe-auth.c that need the host name. What we're about to do to SSL
verification will match that. So I think the docs need a fix here.
regards, tom lane