gss-krb5 when passed a two component acceptor name passes the second component to getaddrinfo() to canonicalize it.   While it is often the case that the second component of a service name is a hostname, it is not always a hostname.   The afs rxgk security class service name is of the form




Names that begin with an underscore are not valid DNS hostnames and should not be passed to getaddrinfo() which will happily issue a query which cannot be successfully resolved.  Underscores are valid for SRV and TXT records.  They are not valid for A/AAAA/CNAME lookups as performed by getaddrinfo().


Kerberos should validate the names passed to getaddrinfo() to avoid unnecessary network queries and timeouts.


A valid host name only consists of [a-z]{A-Z][0-9] and the hyphen ‘-‘.