Re: How to disable DNS lookups?

On 25.07.2017 17:00, Roland C. Dowdeswell wrote:
> On Tue, Jul 25, 2017 at 09:47:18AM +0300, Heikki Lindholm wrote:
>>
> 
>> On 24.07.2017 19:40, Roland C. Dowdeswell wrote:
>>> On Sun, Jul 23, 2017 at 08:23:52AM +0300, Heikki Lindholm wrote:
>>>>
>>>
>>>> The Heimdal version identifies itself as 1.5.2. The main problem is that
>>>> Heimdal doesn't appear to use /etc/hosts for looking up the KDC's IP
>>>> address, but goes to DNS, and fails.
>>>
>>> 1.5.2 is quite old and, IIRC, I've seen this before.  You can work
>>> around it by adding the kdc name with a dot at the end as an alias in
>>> the hosts file.
>>
>> Thank you very much. That trick did it. It's weird, though. I would have
>> likely never arrived at the same solution by myself.
> 
> It's a work-around in the Heimdal code which appends a trailing dot to
> hostnames when looking them up to avoid the DNS search path specified
> in /etc/resolv.conf.  Viktor and I discussed relaxing this yesterday
> because we believe that it is counter-intuitive.  It certainly confused
> me, but I worked it out by reading the code rather than the documentation.
> The approach that we think will work in the short term is to append the
> trailing dot iff the hostname came from DNS SRV RRs as they should not
> honour the DNS search path.  The existing behaviour will be able to be
> replicated by those who are using /etc/krb5.conf by appending their own
> trailing dot to the configured names.
> 
> In the longer term, we should likely stop using getaddrinfo(3) for names
> obtained from DNS SRV RRs and directly query DNS for them as this matches
> expectations.  That is: you wouldn't expect that if you find

Isn't nsswitch.conf there to let the user specify which lookup to prefer 
for getaddrinfo() and others?

MIT krb5's behaviour at least was exactly what I expected, i.e. if 
there's a "kdc = kdc.foo.bar" in krb5.conf, kinit does the same kind of 
lookup as "ping kdc.foo.bar" does (= in my case takes it from /etc/hosts 
without DNS involvement).