[krbdev.mit.edu #8809] Do not call getaddrinfo() with invalid hostnames
Jeffrey Altman via RT <[email protected]>
| Newsgroups | gmane.comp.encryption.kerberos.bugs |
|---|---|
| Message-ID | <[email protected]> |
gss-krb5 when passed a two component acceptor name passes the second component to getaddrinfo() to canonicalize it. While it is often the case that the second component of a service name is a hostname, it is not always a hostname. The afs rxgk security class service name is of the form
afs-rxgk/_afs.<cellname>
Names that begin with an underscore are not valid DNS hostnames and should not be passed to getaddrinfo() which will happily issue a query which cannot be successfully resolved. Underscores are valid for SRV and TXT records. They are not valid for A/AAAA/CNAME lookups as performed by getaddrinfo().
Kerberos should validate the names passed to getaddrinfo() to avoid unnecessary network queries and timeouts.
A valid host name only consists of [a-z]{A-Z][0-9] and the hyphen ‘-‘.
_______________________________________________
krb5-bugs mailing list
[email protected]
https://mailman.mit.edu/mailman/listinfo/krb5-bugs