#

# Force DNS name resolution when canonicalizing hostbased principal names.

#

# This patch is to preserve old standing Solaris Kerberos behavior,

# where hostbased principal names are canonicalized exclusively using DNS

# lookups. NIS has been known to cause issues with hostname canonicalization.

#

# This patch is not meant for upstream contribution.

# Patch source: in-house

#

--- a/src/lib/krb5/os/sn2princ.c

+++ b/src/lib/krb5/os/sn2princ.c

@@ -39,6 +39,14 @@

 #define DEFAULT_RDNS_LOOKUP 1

 #endif

+/*

+ * The following prototypes are needed because these are

+ * private interfaces that do not have prototypes in any .h

+ */

+extern struct hostent   *res_getipnodebyname(const char *, int, int, int *);

+extern struct hostent   *res_getipnodebyaddr(const void *, size_t, int, int *);

+extern void             res_freehostent(struct hostent *);

+

 static krb5_boolean

 use_reverse_dns(krb5_context context)

 {

@@ -53,6 +61,26 @@ use_reverse_dns(krb5_context context)

     return value;

 }

+/*

+ * Translate getipnodeby* error codes to strings for coherent error messaging.

+ */

+static const char *

+get_host_error(int err)

+{

+    switch(err) {

+    case HOST_NOT_FOUND:

+        return "host not found";

+    case NO_DATA:

+        return "no data record of requested type";

+    case NO_RECOVERY:

+        return "non-recoverable error";

+    case TRY_AGAIN:

+        return "host name lookup failure";

+    default:

+        return "error unknown";

+    }

+}

+

 /* Set *name_out to the canonicalized form of name, obeying relevant

  * configuration settings.  The caller must free the result. */

 static krb5_error_code

@@ -63,11 +91,15 @@ canon_hostname(krb5_context context, krb5_int32 type, const char *host,

     char namebuf[NI_MAXHOST], *copy, *p;

     int err;

     const char *canonhost;

+    struct hostent *hp = NULL;

+    struct hostent *hp2 = NULL;

+    int addr_family;

     *canonhost_out = NULL;

     canonhost = host;

     if (type == KRB5_NT_SRV_HST && context->dns_canonicalize_hostname) {

+#if 0

         /* Try a forward lookup of the hostname. */

         memset(&hint, 0, sizeof(hint));

         hint.ai_flags = AI_CANONNAME;

@@ -86,6 +118,31 @@ canon_hostname(krb5_context context, krb5_int32 type, const char *host,

             if (!err)

                 canonhost = namebuf;

         }

+#endif

+        /* using res_getipnodebyname to force dns name resolution*/

+        addr_family = AF_INET;

+try_getipnodebyname_again:

+        hp = res_getipnodebyname(host, addr_family, 0, &err);

+        if (hp == NULL) {

+            if (addr_family == AF_INET) {

+                /* Just in case it's an IPv6-only name.  */

+                addr_family = AF_INET6;

+                goto try_getipnodebyname_again;

+            }

+            k5_setmsg(context, KRB5_ERR_BAD_HOSTNAME,

+                      _("Hostname cannot be canonicalized for '%s': %s"),

+                      host, get_host_error(err));

+            return KRB5_ERR_BAD_HOSTNAME;

+        }

+        canonhost = hp->h_name;

+

+        if (use_reverse_dns(context)) {

+            /* Try a reverse lookup of the address. */

+            hp2 = res_getipnodebyaddr(hp->h_addr, hp->h_length,

+                                      hp->h_addrtype, &err);

+            if (hp2 != NULL)

+                canonhost = hp2->h_name;

+        }

     }

     copy = strdup(canonhost);

@@ -110,9 +167,12 @@ canon_hostname(krb5_context context, krb5_int32 type, const char *host,

     *canonhost_out = copy;

 cleanup:

-    /* We only return success or ENOMEM. */

     if (ai != NULL)

         freeaddrinfo(ai);

+    if (hp != NULL)

+        res_freehostent(hp);

+    if (hp2 != NULL)

+        res_freehostent(hp2);

     return (*canonhost_out == NULL) ? ENOMEM : 0;

 }

--- a/src/util/k5test.py

+++ b/src/util/k5test.py

@@ -364,6 +364,7 @@ import string

 import subprocess

 import sys

 import imp

+import re

 # Used when most things go wrong (other than programming errors) so

 # that the user sees an error message rather than a Python traceback,

@@ -485,7 +486,19 @@ def _find_srctop():

 # because it explicitly prefers results containing periods and

 # krb5_sname_to_principal doesn't care.

 def _get_hostname():

+    # in Solaris, we always canonicalize using FQDN by forcing DNS lookup

     hostname = socket.gethostname()

+    # dig for fqdn, only output answer section

+    answer = subprocess.check_output(['/usr/sbin/dig', '+search', '+noall', '+answer', hostname]);

+    for line in answer.split("\n"):

+        # find A record

+        if re.search(r"\bA\b", line):

+            # only cut out the NAME part

+            return re.sub(r'\.?[ \t].*','',line)

+

+    fail('Local hostname "%s" does not resolve: %s.' % (hostname, errstr))

+

+    # unreachable:

     try:

         ai = socket.getaddrinfo(hostname, None, 0, 0, 0, socket.AI_CANONNAME)

     except socket.gaierror, (error, errstr):