Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

gethostbyname: Only returns one IPv4 address per domain, no IPv6 #2363

Open
sebix opened this issue May 15, 2023 · 0 comments
Open

gethostbyname: Only returns one IPv4 address per domain, no IPv6 #2363

sebix opened this issue May 15, 2023 · 0 comments

Comments

@sebix
Copy link
Member

sebix commented May 15, 2023

The gethostbyname expert resolves a domain name (*.fqdn) to the IP address (*.ip), but

  • only one IP address, not all of the A-records
  • only for IPv4, not for IPv6
    because socket.gethostbyname works this way

This has only limited benefits.
When the input event contains a URL/FQDN and you want to compare that to firewall entries, you always need all IP address this IP resolves to, not just anyone.
When you want to block hosts based on their IP addresses, you also need to block all of them.
Only if you want to get any contact data for the host, one IP address suffices.

Alternative Python calls are

  • socket.gethostbyname_ex, which returns a list of addresses per host, but only IPv4
  • socket.getaddrinfo also returns IPv6 addresses, but requests a destination port and is therefore unsuitable for our purpose.
    So what's left is using dnspython
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant