Hello

currently it is not possible to create a SPA packet without configuring a RESOLVE_URL in .fwknoprc file. The error message is:

[-] Could not resolve IP via: '/usr/bin/wget -U Fwknop/2.6.10 --secure-protocol=auto --quiet -O - https://www.cipherdyne.org/cgi-bin/myip'


Reason: The default host used to determine the own IP (www.cipherdyne.org, defined in https://github.com/mrash/fwknop/blob/3e9a05750679136fec0e2b34654efdda0688b015/client/fwknop_common.h#L61C38-L61C56) (currently?) cannot be resolved correctly:

dig @8.8.8.8 www.cipherdyne.org

; <<>> DiG 9.18.16-1~deb12u1-Debian <<>> @8.8.8.8 www.cipherdyne.org
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48631
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;www.cipherdyne.org.            IN      A

;; ANSWER SECTION:
www.cipherdyne.org.     14400   IN      CNAME   cipherdyne.org.
cipherdyne.org.         14400   IN      A       127.0.0.1

;; Query time: 168 msec
;; SERVER: 8.8.8.8#53(8.8.8.8) (UDP)
;; WHEN: Tue Jul 18 08:29:54 CEST 2023
;; MSG SIZE  rcvd: 77


There is a fallback host (www.cipherdyne.com, https://github.com/mrash/fwknop/blob/3e9a05750679136fec0e2b34654efdda0688b015/client/fwknop_common.h#L62C38-L62C56) which should be used in case of an error (https://github.com/mrash/fwknop/blob/3e9a05750679136fec0e2b34654efdda0688b015/client/http_resolve_host.c#L562) but I think that the DNS problem occures before reaching that point in code.
The backup host itself is working; when adding
RESOLVE_URL https://www.cipherdyne.com/cgi-bin/myip
to my .fwknoprc all is working fine.


I expect this to be an upstream problem – but I'm not 100% sure :-)


Thank you
Patrick

The DNS problems regarding www.cipherdyne.org are solved,
https://www.cipherdyne.org/cgi-bin/myip is working as expected.

So everything works as expected again.


But the bug is still there – maybe you can have a short look and (if
not a Debian problem) push it upstream.
But there is absolutely no urgency – I think this has been a
extremly rare event.


Thanks for bringing the package into Debian. Great work!



Best wishes

Patrick

Sorry for the long delay Patrick.

I also noticed this on one of my machines.

Yes, I would say so. It would be good if the fallback could cases like
these, though maybe it's not easy to do, I'm not sure.

Would you like to suggest this upstream
(https://github.com/mrash/fwknop/issues), or would you prefer I do it?

The only somewhat related issue I could find is
https://github.com/mrash/fwknop/issues/168 (from 8 years ago).

Francois