Skip Menu |

Subject: bug report: "too many SRV records" becomes "no SRV records"
From: "Richard E. Silverman" <>
Date: Wed, 09 Jun 2010 17:33:44 -0400
To: undisclosed-recipients:;
The following message is a courtesy copy of an article
that has been posted to comp.protocols.kerberos as well.

In 1.8.1, there is the following code in src/lib/krb5/os/dnsglue.c:

krb5int_dns_init(struct krb5int_dns_state **dsp,
char *host, int nclass, int ntype)
nextincr = 2048;
maxincr = INT_MAX;

One day, due to an error, the number of KDC SRV records for one of our
realms doubled from 27 to 54... and KDC lookups via DNS prompty broke. I
bumped up the nextincr value above, and it started working again.
Probably not the right fix, but just letting you know that there's a bug

Richard Silverman
From the kerberos list discussion, the platform this behavior was
observed on was Solaris 10 / x86.

The obvious possibility is that the resolver is returning -1 when the
response is too big for the buffer, instead of the size of the response
as we expect.