IPv6 address being parsed as IPv4

[joelbu]

Hello Dan,
Hello everyone,

I get the following traceback

$ sudo openconnect sslvpn.myschool.tld -u buschjo@myschool.tld -g student-net -s 'vpn-slice --dump netseminar.myschool.tld'
POST https://sslvpn.myschool.tld/student-net
Connected to 1.2.3.4:443
SSL negotiation with sslvpn.myschool.tld
Connected to HTTPS on sslvpn.myschool.tld
XML POST enabled
Fuer eine Verbindung in die entsprechende VPN-Gruppe (VPZ) muss beim Feld "Connect to" "sslvpn.myschool.tld/VPZ_NAME" eingegeben werden, beim Feld Benutzername "Benutzername@REALM.myschool.tld"
=> Aktuell ist student-net selektiert
=> Login: username@student-net.myschool.tld
Bitte geben Sie Benutzernamen und Passwort ein.
Password:
POST https://sslvpn.myschool.tld/
Got CONNECT response: HTTP/1.1 200 OK
CSTP connected. DPD 30, Keepalive 30
Connected as 5.6.7.8 + 2001:1:2:3:4::ab/115, using SSL, with DTLS in progress
Established DTLS connection (using GnuTLS). Ciphersuite (DTLS1.2)-(ECDHE-(null))-(AES-256-GCM).
Exception while setting dns from environment variable INTERNAL_IP4_DNS='31.31.31.31 32.32.32.32 2001:555:8888::c'
Traceback (most recent call last):
  File "/usr/local/bin/vpn-slice", line 11, in <module>
    load_entry_point('vpn-slice==0.11', 'console_scripts', 'vpn-slice')()
  File "/usr/local/lib/python3.7/site-packages/vpn_slice/main.py", line 399, in main
    p, args, env = parse_args_and_env()
  File "/usr/local/lib/python3.7/site-packages/vpn_slice/main.py", line 357, in parse_args_and_env
    env = parse_env(environ)
  File "/usr/local/lib/python3.7/site-packages/vpn_slice/main.py", line 293, in parse_env
    try: val = maker(environ[envar])
  File "/usr/local/lib/python3.7/site-packages/vpn_slice/main.py", line 276, in <lambda>
    ('dns','INTERNAL_IP4_DNS',lambda x: [IPv4Address(x) for x in x.split()],[]),
  File "/usr/local/lib/python3.7/site-packages/vpn_slice/main.py", line 276, in <listcomp>
    ('dns','INTERNAL_IP4_DNS',lambda x: [IPv4Address(x) for x in x.split()],[]),
  File "/usr/lib64/python3.7/ipaddress.py", line 1327, in __init__
    self._ip = self._ip_int_from_string(addr_str)
  File "/usr/lib64/python3.7/ipaddress.py", line 1161, in _ip_int_from_string
    raise AddressValueError("Expected 4 octets in %r" % ip_str)
ipaddress.AddressValueError: Expected 4 octets in '2001:67c:10ec::c'
Script 'vpn-slice --dump netseminar.myschool.tld' returned error 1
Exception while setting dns from environment variable INTERNAL_IP4_DNS='31.31.31.31 32.32.32.32 2001:555:8888::c'
Traceback (most recent call last):
  File "/usr/local/bin/vpn-slice", line 11, in <module>
    load_entry_point('vpn-slice==0.11', 'console_scripts', 'vpn-slice')()
  File "/usr/local/lib/python3.7/site-packages/vpn_slice/main.py", line 399, in main
    p, args, env = parse_args_and_env()
  File "/usr/local/lib/python3.7/site-packages/vpn_slice/main.py", line 357, in parse_args_and_env
    env = parse_env(environ)
  File "/usr/local/lib/python3.7/site-packages/vpn_slice/main.py", line 293, in parse_env
    try: val = maker(environ[envar])
  File "/usr/local/lib/python3.7/site-packages/vpn_slice/main.py", line 276, in <lambda>
    ('dns','INTERNAL_IP4_DNS',lambda x: [IPv4Address(x) for x in x.split()],[]),
  File "/usr/local/lib/python3.7/site-packages/vpn_slice/main.py", line 276, in <listcomp>
    ('dns','INTERNAL_IP4_DNS',lambda x: [IPv4Address(x) for x in x.split()],[]),
  File "/usr/lib64/python3.7/ipaddress.py", line 1327, in __init__
    self._ip = self._ip_int_from_string(addr_str)
  File "/usr/lib64/python3.7/ipaddress.py", line 1161, in _ip_int_from_string
    raise AddressValueError("Expected 4 octets in %r" % ip_str)
ipaddress.AddressValueError: Expected 4 octets in '2001:555:8888::c'
Script 'vpn-slice --dump netseminar.myschool.tld' returned error 1

It seems to me that the environment variable INTERNAL_IP4_DNS should never contain an IPv6 address, I suspect this might be a mistake of my organization, would you agree?
Do you happen to have an idea how I could work around this?

Best
--Joel

[joelbu]

I think I hacked together a pretty usable workaround. It was much easier to find the place in the code than I initially thought.

I just used a small function as the maker for dns so that it ignores any non-IPv4 addresses.

def parse_dns(raw_string):
    result = []
    for addr_string in raw_string.split():
        addr = ip_address(addr_string)
        if isinstance(addr, IPv4Address):
            result.append(addr)
    return result

# Translate environment variables which may be passed by our caller
# into a more Pythonic form (these are take from vpnc-script)
reasons = Enum('reasons', 'pre_init connect disconnect reconnect attempt_reconnect')
vpncenv = [
    ('reason','reason',lambda x: reasons[x.replace('-','_')]),
    ('gateway','VPNGATEWAY',ip_address),
    ('tundev','TUNDEV',str),
    ('domain','CISCO_DEF_DOMAIN',lambda x: x.split(),[]),
    ('banner','CISCO_BANNER',str),
    ('myaddr','INTERNAL_IP4_ADDRESS',IPv4Address), # a.b.c.d
    ('mtu','INTERNAL_IP4_MTU',int),
    ('netmask','INTERNAL_IP4_NETMASK',IPv4Address), # a.b.c.d
    ('netmasklen','INTERNAL_IP4_NETMASKLEN',int),
    ('network','INTERNAL_IP4_NETADDR',IPv4Address), # a.b.c.d
    ('dns','INTERNAL_IP4_DNS',parse_dns),
    ('nbns','INTERNAL_IP4_NBNS',lambda x: [IPv4Address(x) for x in x.split()],[]),
    ('myaddr6','INTERNAL_IP6_ADDRESS',IPv6Interface), # x:y::z or x:y::z/p
    ('netmask6','INTERNAL_IP6_NETMASK',IPv6Interface), # x:y:z:: or x:y::z/p
    ('dns6','INTERNAL_IP6_DNS',lambda x: [IPv6Address(x) for x in x.split()],[]),
    ('nsplitinc','CISCO_SPLIT_INC',int,0),
    ('nsplitexc','CISCO_SPLIT_EXC',int,0),
    ('nsplitinc6','CISCO_IPV6_SPLIT_INC',int,0),
    ('nsplitexc6','CISCO_IPV6_SPLIT_EXC',int,0),
    ('idle_timeout','IDLE_TIMEOUT',int,600),
]

It's probably not in your interest to try and fix others peoples configuration bugs in your code, so I won't make a pull request for this, but I'll just leave it here if anyone needs this. Anyone can have my change under GPLv3 or later, of course, like the project.

Sorry for opening an issue this quickly instead of first investigating more.

Best regards,
Joel

[dlenski]

Hi @joelbu, thanks for the useful and detailed issue report…

It seems to me that the environment variable INTERNAL_IP4_DNS should never contain an IPv6 address, I suspect this might be a mistake of my organization, would you agree?

Actually, I think this is a perfectly reasonable configuration: your VPN routes IPv6 traffic and assigns an IPv6 address, so it's reasonable for a DNS server to be referred to by its IPv6 address even if it's being used to look up IP4 addresses.

Unfortunately, I have no access to a VPN that supports IPv6, so no good way to test IPv6 behavior currently…

Could you please do the following? While connected to the network, and ensuring that you have routed traffic to both the IPv4 and IPv6 addresses of the DNS servers… can you attempt DNS lookups using both the IPv4 and IPv6 addresses of the DNS servers?

# Ensure traffic is routed to all 3 addresses via VPN:
#    INTERNAL_IP4_DNS='31.31.31.31 32.32.32.32 2001:555:8888::c'
#
# Do all three DNS queries return useful information?
# Do they all return BOTH IPv4 AND IPv6 addresses?

$ dig @31.31.31.31 some.domain.schule.de

$ dig @32.32.32.32 some.domain.schule.de

$ dig @2001:555:8888::c some.domain.schule.de

If my educated guess about the functionality proves correct in your testing, I'll modify vpn-slice accordingly…

[dlenski]

This is a much simpler patch to ensure that only IP addresses of “matching version” are included for DNS servers… but like I wrote above it may not actually be desirable…

diff --git a/vpn_slice/main.py b/vpn_slice/main.py
index e04844a..fea2689 100755
--- a/vpn_slice/main.py
+++ b/vpn_slice/main.py
@@ -273,11 +273,11 @@ vpncenv = [
     ('netmask','INTERNAL_IP4_NETMASK',IPv4Address), # a.b.c.d
     ('netmasklen','INTERNAL_IP4_NETMASKLEN',int),
     ('network','INTERNAL_IP4_NETADDR',IPv4Address), # a.b.c.d
-    ('dns','INTERNAL_IP4_DNS',lambda x: [IPAddress(x) for x in x.split()],[]),
+    ('dns','INTERNAL_IP4_DNS',lambda x: [ip_address(x) for x in x.split() if ip_address(x).version==4],[]),
     ('nbns','INTERNAL_IP4_NBNS',lambda x: [IPAddress(x) for x in x.split()],[]),
     ('myaddr6','INTERNAL_IP6_ADDRESS',IPv6Interface), # x:y::z or x:y::z/p
     ('netmask6','INTERNAL_IP6_NETMASK',IPv6Interface), # x:y:z:: or x:y::z/p
-    ('dns6','INTERNAL_IP6_DNS',lambda x: [IPAddress(x) for x in x.split()],[]),
+    ('dns6','INTERNAL_IP6_DNS',lambda x: [ip_address(x) for x in x.split() if ip_address(x).version==6],[]),
     ('nsplitinc','CISCO_SPLIT_INC',int,0),
     ('nsplitexc','CISCO_SPLIT_EXC',int,0),
     ('nsplitinc6','CISCO_IPV6_SPLIT_INC',int,0),

[joelbu]

Sure I'm happy to help, here you go:

$ dig @31.31.31.31 some.domain.schule.de

; <<>> DiG 9.11.11-DistroVersion <<>> @31.31.31.31 some.domain.schule.de
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 38702
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4000
; COOKIE: 42cc6320bbaf296ba1a3cdfd5dcc76c72d534576883bd8c5 (good)
;; QUESTION SECTION:
;some.domain.schule.de.         IN      A

;; AUTHORITY SECTION:
schule.de.              170     IN      SOA     dns.schule.de. ballier.mail.schule.de. 2019102001 10800 3600 604800 10800

;; Query time: 9 msec
;; SERVER: 31.31.31.31#53(31.31.31.31)
;; WHEN: Mi Nov 13 22:33:59 CET 2019
;; MSG SIZE  rcvd: 149

$ dig @32.32.32.32 some.domain.schule.de

; <<>> DiG 9.11.11-DistroVersion <<>> @32.32.32.32 some.domain.schule.de
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 60214
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4000
; COOKIE: 8c0ed9351898908674654f785dcc76de0fe049c234c59e0d (good)
;; QUESTION SECTION:
;some.domain.schule.de.         IN      A

;; AUTHORITY SECTION:
schule.de.              147     IN      SOA     dns.schule.de. ballier.mail.schule.de. 2019102001 10800 3600 604800 10800

;; Query time: 10 msec
;; SERVER: 32.32.32.32#53(32.32.32.32)
;; WHEN: Mi Nov 13 22:34:22 CET 2019
;; MSG SIZE  rcvd: 149

$ dig @2001:555:8888::c some.domain.schule.de

; <<>> DiG 9.11.11-DistroVersion <<>> @2001:555:8888::c some.domain.schule.de
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 824
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4000
; COOKIE: e981c35261fe4c720f58eef25dcc76ee3d9e7eda73fd5486 (good)
;; QUESTION SECTION:
;some.domain.schule.de.         IN      A

;; AUTHORITY SECTION:
schule.de.              131     IN      SOA     dns.schule.de. ballier.mail.schule.de. 2019102001 10800 3600 604800 10800

;; Query time: 11 msec
;; SERVER: 2001:555:8888::c#53(2001:555:8888::c)
;; WHEN: Mi Nov 13 22:34:38 CET 2019
;; MSG SIZE  rcvd: 149

So it seems you were right, even though the DNS server is addressed by its IPv6 address it has no issue with resolving IPv4 hosts. I didn't realize the environment variable name was referring to the servers' function rather than their method of accessing them.

I also tried with schule.de and myschool.tld both returned IPv4 addresses

Then I did it with AAAA and myschool.tld

$ dig @31.31.31.31 myschool.tld AAAA

; <<>> DiG 9.11.11-DistroVersion <<>> @31.31.31.31 myschool.tld AAAA
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37567
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4000
; COOKIE: d9e9e0ad9b7060d5a6b8ddc45dcc7c8d4c6a99223b2383ce (good)
;; QUESTION SECTION:
;myschool.tld.                       IN      AAAA

;; ANSWER SECTION:
myschool.tld.                349     IN      AAAA    2001:444:7777:123::456

;; Query time: 13 msec
;; SERVER: 31.31.31.31#53(31.31.31.31)
;; WHEN: Mi Nov 13 22:58:37 CET 2019
;; MSG SIZE  rcvd: 92

$ dig @32.32.32.32 myschool.tld AAAA

; <<>> DiG 9.11.11-DistroVersion <<>> @32.32.32.32 myschool.tld AAAA
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 26870
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4000
; COOKIE: cf50928e206311b03524bf9a5dcc7c95534829ba7ed44652 (good)
;; QUESTION SECTION:
;myschool.tld.                       IN      AAAA

;; ANSWER SECTION:
myschool.tld.                341     IN      AAAA    2001:444:7777:123::456

;; Query time: 9 msec
;; SERVER: 32.32.32.32#53(32.32.32.32)
;; WHEN: Mi Nov 13 22:58:45 CET 2019
;; MSG SIZE  rcvd: 92

$ dig @2001:555:8888::c myschool.tld AAAA

; <<>> DiG 9.11.11-DistroVersion <<>> @2001:555:8888::c myschool.tld AAAA
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 64834
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4000
; COOKIE: 30837d1c506fe6a911e677fc5dcc7c99c910c142490f8290 (good)
;; QUESTION SECTION:
;myschool.tld.                       IN      AAAA

;; ANSWER SECTION:
myschool.tld.                337     IN      AAAA    2001:444:7777:123::456

;; Query time: 10 msec
;; SERVER: 2001:555:8888::c#53(2001:555:8888::c)
;; WHEN: Mi Nov 13 22:58:49 CET 2019
;; MSG SIZE  rcvd: 92

So in conclusion:

Do all three DNS queries return useful information?

Yes.

Do they all return BOTH IPv4 AND IPv6 addresses?

When I specifically ask for it and the hostname has an IPv6 address associated then yes.

Concerning your patch, as I was writing my workaround I knew there needed to be a way I could just integrate that into the list comprehension, now it looks so obvious :)

[joelbu]

Also one more thing, I tested doing it like this

('dns','INTERNAL_IP4_DNS',lambda x: [ip_address(x) for x in x.split()],[]),
...
('dns6','INTERNAL_IP6_DNS',lambda x: [ip_address(x) for x in x.split()],[]),

but that results in

/usr/bin/dig: couldn't get address for '2001:555:8888::c': address family not supported
WARNING: Lookup for netseminar.myschool.tld on VPN DNS servers failed.

Edit: Ah yes of course the assembled command line is

/usr/bin/dig +short +noedns -b 5.6.7.8 @31.31.31.31 @32.32.32.32 @2001:555:8888::c +domain=myschool.tld netseminar.myschool.tld

You'd need to use the IPv6 bind address with the IPv6 server address.

[dlenski]

So in conclusion:

Do all three DNS queries return useful information?

Yes.

Do they all return BOTH IPv4 AND IPv6 addresses?

When I specifically ask for it and the hostname has an IPv6 address associated then yes.

Perfect. Thanks very much for verifying this 👍

/usr/bin/dig: couldn't get address for '2001:555:8888::c': address family not supported
WARNING: Lookup for netseminar.myschool.tld on VPN DNS servers failed.

You'd need to use the IPv6 bind address with the IPv6 server address.

I think you're right. This is getting a little messy since I'm not 100% sure what combination of bind addresses and server addresses dig can accept in combination with each other… without its brain exploding? 😂

Want to code it up and test and submit a PR? I could take a stab at rolling it all together but it'll probably have a few small mistakes like the warning you found, because I can't actually test against a real IPv6 VPN.

[joelbu]

Another interesting tidbit, if I dump the environment variables then INTERNAL_IP6_DNS does not even turn up. I guess it's not useful to my school if the three in INTERNAL_IP4_DNS can already handle any kind of request.

[joelbu]

Want to code it up and test and submit a PR?

I can try, but it might take me a few days.

[joelbu]

Okay I already had time today. It's over there #30