search

openziti / desktop-edge-win

Provides a Ziti client for Windows
Apache License 2.0
35 stars 13 forks source link

nslookup returns ipv6 address for intercepted DNS #222

Closed dovholuknf closed 3 years ago

dovholuknf commented 3 years ago

user tried to use nslookup but a surprising ipv6 address was returned

Name:    sftpnfn.ziti
Addresses:  6440:6:6469:6964:6e73:7072:7072:6430
          100.64.0.6

determine if this is nslookup doing 'strange things' or if AAAA records are not handled properly - figure out why an IPv6 would be returned at all

dovholuknf commented 3 years ago

This turned out to be a bug with the desktop edge returning an A record answer to a AAAA question. Currently we do not support local ipv6 or intercepted ipv6 addresses. Updating the code to return a successful response but no answer.

see https://tools.ietf.org/html/rfc4074 :

3.  Expected Behavior
   Suppose that an authoritative server has an A RR but has no AAAA RR
   for a host name.  Then, the server should return a response to a
   query for an AAAA RR of the name with the response code (RCODE) being
   0 (indicating no error) and with an empty answer section (see
   Sections 4.3.2 and 6.2.4 of [1]).  Such a response indicates that
   there is at least one RR of a different type than AAAA for the
   queried name, and the stub resolver can then look for A RRs.