postgres.git / summary / log / commit / refs

commit    0787432f33fbbda4f628f4499468a3f7d0bc11ad
Author:   Stephen Frost <sfrost@snowman.net>
Date:     Fri Apr 07 23:36:25 2023 +0000
First released in: 11.20, 12.15, 13.11, 14.8, 15.3

    For Kerberos testing, disable reverse DNS lookup
    
    In our Kerberos test suite, there isn't much need to worry about the
    normal canonicalization that Kerberos provides by looking up the reverse
    DNS for the IP address connected to, and in some cases it can actively
    cause problems (eg: a captive portal wifi where the normally not
    resolvable localhost address used ends up being resolved anyway, and
    not to the domain we are using for testing, causing the entire
    regression test to fail with errors about not being able to get a TGT
    for the remote realm for cross-realm trust).
    
    Therefore, disable it by adding rdns = false into the krb5.conf that's
    generated for the test.
    
    Reviewed-By: Heikki Linnakangas
    Discussion: https://postgr.es/m/Y/QD2zDkDYQA1GQt@tamriel.snowman.net


 src/test/kerberos/t/001_auth.pl | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/src/test/kerberos/t/001_auth.pl b/src/test/kerberos/t/001_auth.pl
index b7418cbb6e5..ec24db48ed2 100644
--- a/src/test/kerberos/t/001_auth.pl
+++ b/src/test/kerberos/t/001_auth.pl
@@ -96,6 +96,17 @@ $stdout =~ m/Kerberos 5 release ([0-9]+\.[0-9]+)/
   or BAIL_OUT("could not get Kerberos version");
 $krb5_version = $1;
 
+# Build the krb5.conf to use.
+#
+# Explicitly specify the default (test) realm and the KDC for
+# that realm to avoid the Kerberos library trying to look up
+# that information in DNS, and also because we're using a
+# non-standard KDC port.
+#
+# Reverse DNS is explicitly disabled to avoid any issue with a
+# captive portal or other cases where the reverse DNS succeeds
+# and the Kerberos library uses that as the canonical name of
+# the host and then tries to acquire a cross-realm ticket.
 append_to_file(
 	$krb5_conf,
 	qq![logging]
@@ -104,6 +115,7 @@ kdc = FILE:$kdc_log
 
 [libdefaults]
 default_realm = $realm
+rdns = false
 
 [realms]
 $realm = {


[parent: d6ac2348b8a1]