Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset="utf-8" Content-Length: 2311

gss-krb5 when passed a two component acceptor name passes the second component to getaddrinfo() to canonicalize it.   While it is often the case that the second component of a service name is a hostname, it is not always a hostname.   The afs rxgk security class service name is of the form

 

   afs-rxgk/_afs.<cellname>

 

Names that begin with an underscore are not valid DNS hostnames and should not be passed to getaddrinfo() which will happily issue a query which cannot be successfully resolved.  Underscores are valid for SRV and TXT records.  They are not valid for A/AAAA/CNAME lookups as performed by getaddrinfo().

 

Kerberos should validate the names passed to getaddrinfo() to avoid unnecessary network queries and timeouts.

 

A valid host name only consists of [a-z]{A-Z][0-9] and the hyphen ‘-‘.