1657928 - Invalid hostname IP detection

Status: RESOLVED INVALID

(Core :: Networking: DNS, defect)

Description

[lexunin]

Attachment: http_301_redirect.har

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:79.0) Gecko/20100101 Firefox/79.0

Steps to reproduce:

URL where the issue potentially can be reproduced, but if 'showheroes.com' will be no more delivered there HAR file is attached.

https://www.rtl.de/cms/42-tage-wettertrend-hundstage-2020-enden-im-absturz-4548149.html?utm_term=rtl-aktuell&utm_medium=echobox&utm_campaign=post&utm_source=Facebook

The case:

• Page starts to load
  (filter network requests by showheroes.com)
• First request goes to the domain receiver-hetzner.showheroes.com and domain IP gets resolved to 138.201.223.17. HTTP2 is in use.
• Few requests after that, another request being made to the domain video-library.showheroes.com and for some reason it gets resolved to 138.201.223.17 as well (but should be one of the 167.233.6.*), but the IP even never were in the A-records DNS index for that domain. Nginx on our side makes 301 redirect and forwards the request to the domain receiver-hetzner.showheroes.com, and obviously fails with 404 error afterwards.

Actual results:

video-library.showheroes.com were resolved to 138.201.223.17

Expected results:

video-library.showheroes.com should be resolved to 167.233.6.11/167.233.6.12/167.233.6.13/167.233.6.14

Comment 1

[:Gijs (he/him)]

Did you intend to mark this as a security-sensitive issue?

Comment 2

[lexunin]

Well, better to be safe than sorry. If there is a bug which allows to redirect user's traffic from one domain to another IP address without user even noticing it, I suppose it's better to keep it in secret until it's fixed.

Comment 3

[Daniel Veditz [:dveditz]]

This site is using the Alt-Svc mechanism to coalesce the content over one HTTP/2 connection. If you disable it using the advanced preference network.http.altsvc.enabled it will use the IP addresses you expected.

specification: https://tools.ietf.org/html/rfc7838

Comment 4

[lexunin]

Thank you Daniel! We will investigate further. If you have any more details, we will appreciate if you would send us what to look at. Thanks again and have a nice weekend.