Skip to content

Commit 8977a80

Browse files
committed
Don't attempt to canonicalize peer name in Kerberos/GSSAPI/SSPI auth
libpq does not canonicalize and neither should we, because: 1) it's likely the wrong thing to do and removes control from the user; 2) it introduces a blocking DNS lookup into an async path, which is not great.
1 parent 98aebf1 commit 8977a80

File tree

1 file changed

+1
-4
lines changed

1 file changed

+1
-4
lines changed

asyncpg/protocol/coreproto.pyx

+1-4
Original file line numberDiff line numberDiff line change
@@ -747,15 +747,12 @@ cdef class CoreProtocol:
747747

748748
cdef _auth_gss_get_spn(self):
749749
service_name = self.con_params.krbsrvname or 'postgres'
750-
# find the canonical name of the server host
751750
if isinstance(self.address, str):
752751
raise apg_exc.InternalClientError(
753752
'GSSAPI/SSPI authentication is only supported for TCP/IP '
754753
'connections')
755754

756-
host = self.address[0]
757-
host_cname = socket.gethostbyname_ex(host)[0]
758-
return f'{service_name}/{host_cname}'
755+
return f'{service_name}/{self.address[0]}'
759756

760757
cdef _auth_gss_step(self, bytes server_response):
761758
cdef:

0 commit comments

Comments
 (0)