ghidra: Canonical Name Resolution breaks DNS

Describe the bug When hosting Ghidra server using an a cloud managed (AWS/Google/Azure) instance ghidra will resolve a canonical DNS hostname for whatever hostname is provided. In this case it will resolve a DNS entry of the type ec2-x-x-x-x.REGION.compute.amazonaws.com. So even if a DNS entry is created “my-ghidra-server.example.com”, in the ghidra project file, the reverse IP entry is stored. This is because Ghidra uses host = InetNameLookup.getCanonicalHostName(host); prior to storing the host name that was entered by the user.

This happens https://github.com/NationalSecurityAgency/ghidra/blob/master/Ghidra/Framework/FileSystem/src/main/java/ghidra/framework/client/ClientUtil.java#L111

The problem is encountered when the IP address needs to change, either because the machine was cycled, or moved. Since ghidra is only storing the getCanonicalHostName and not the DNS entry the user provided, Ghidra will be unable to connect.

To Reproduce Steps to reproduce the behavior:

  1. Run ghidra server on a cloud hosting provider
  2. Create a DNS entry which maps to the that servers IP
  3. Connect using the ghidra client to that shared workspace
  4. Not in the project file that the canonical hostname is resolved, not the DNS entrry
  5. Restart the cloud instance, update the DNS entry to point to the new IP

Expected behavior Ghidra should respect the hostname the user provides and not try to resolve an additional hostname. In this specific case the DNS entry the user entered should be store

Environment:

  • OS: Mac
  • Java Version: 11.0
  • Ghidra Version: 10.2.2
  • Ghidra Origin: official GitHub distro

Additional context This is helpful for ghidra servers which are ephemeral, and do not need to be running continuously.

About this issue

  • Original URL
  • State: closed
  • Created a year ago
  • Reactions: 4
  • Comments: 16

Commits related to this issue

Most upvoted comments

@ryanmkurtz @ghidra1 As an alternate solution to cloud canonical naming issues, PR #3396 enables SNI support to the Ghidra client. Then we can use AWS NLBs in front of Ghidra Server that allow us to setup custom Reverse DNS records. That PR never gained any traction, but I figured I’d make a shameless plug 😃

@dtshepherd, Sorry, this is the first I have seen that PR - it must have slipped under the radar - can’t seem to keep up 😃 I am unfamiliar with SNI so I will need to consider that PR.

The canonical hostname use gets entangled in how we normalize server connection references to ensure proper connection re-use. It is unclear what is an appropriate key to use to get proper connection re-use when the server could have multiple address forms.