Re: Setting DNS Servers Manually?

[Michael B Allen <miallen@ioplex.com>]

On Thu, 18 Oct 2007 12:45:45 +0200
Buchan Milne <bgmilne@mandriva.org> wrote:

> On Thursday 18 October 2007 07:57:00 Michael B Allen wrote:
> > On Wed, 17 Oct 2007 21:44:17 -0700
> >
> > "Henry B. Hotz" <hotz@jpl.nasa.gov> wrote:
> > > I'm not sure I understand.
> > >
> > > If you put everything in the krb5.conf then it doesn't need to do SRV
> > > record lookup.  You could setenv KRB5_CONFIG to an application-
> > > specific config file.  Maybe you can even put the Krb servers in as
> > > IP numbers instead of DNS names.  Was that the sort of thing you were
> > > looking for?
> >
> > Hi Henry,
> >
> > Actually I already do that mostly. I bypass the SRV lookups by doing
> > those myself. And I added a krb5_config_set function to set the kdc
> > (and kpasswd_server for password setting). But still libkrb5 needs to
> > do at least A record lookups and I wouldn't be surprised to find some
> > logic that still provokes SRV lookups or need to do them for some reason.
> >
> > Converting to IP before krb5_config_set-ing seems seems like it could
> > lead to trouble since Kerberos needs FQDNs to pick out realms, generate
> > names, etc.
> >
> > Also, what I really want to do is channel all DNS queries through my
> > DNS lib so I provide consistent DNS server fallback behavior, caching,
> > server "stickiness", etc.
> >
> > But for now I would be happy if I could just overload gethostbyname. So
> > basically I want to create a 'libmyresolv' that has a my_gethostbyname
> > function and then modify Heimdal to use it. Unfortunately the libmyresolv
> > would need to link with my libs that link with Heimdal which creates a
> > nasty circular dependency. Still haven't wrapped my head around that one.
> 
> 
> Not necessarily, if the function names are the same as libresolv, you should 
> in theory be able to set LD_PRELOAD to your libmyresolv.

Hi Buchan,

Nah, I can't use LD_PRELOAD. This needs to be a solid long term solution.

> And maybe you should consider contributing your changes upstream, so none of 
> this is necessary in future, and *all* apps on the host benefit from this.

You mean all Heimdal apps? Yeah, sure. If Love would accept a dlopen
plugin that might be a good way to go. That would solve my circular
dependency too.

Coupled with the recent CC ops plugin discussion perhaps Heimdal would
benefit from a generic modules interface with a modules directory
containing mod_ccmmap.so, mod_resolv.so, etc.

Mike

-- 
Michael B Allen
PHP Active Directory SPNEGO SSO
http://www.ioplex.com/