Help with writing a response modifier

[DWAK-ATTK]

My actual project has many rules and boring bits that just distract. I'm going to simplify what I am trying to do to an absurd amount - just understand that this represents the core of the problem and not the actual project.

First, thank you for the wonderful DNS library. It is much appreciated!

Second, I'm not sure where else to turn to for help with this. I'm not a DNS expert. I apologize if this is not the right place to ask.

I've modified DnsServer.cs to allow me to alter the Response from the Responded event handler:
Around line 128:

IResponse response = await resolver.Resolve(request).ConfigureAwait(false);
RespondedEventArgs respondedEventArgs = new RespondedEventArgs(request, response, data, remote);
OnEvent(Responded, respondedEventArgs);
await udp
    .SendAsync(respondedEventArgs.Response.ToArray(), respondedEventArgs.Response.Size, remote)
    .WithCancellationTimeout(TimeSpan.FromMilliseconds(UDP_TIMEOUT)).ConfigureAwait(false);

Then I used the Server example as a base, and modified it to alter the B octet of all responses:

private static void Server_Responded(object sender, DnsServer.RespondedEventArgs e) {
	if(RecordType.A == e.Request.Questions[0].Type) {
		string[] ipParts = { };
		bool matched = false;
		List<IPAddressResourceRecord> answers = new List<IPAddressResourcerecord>();
		foreach (IResourceRecord answer in e.Response.AnswerRecords) {
			if (typeof(IPAddressResourceRecord) == answer.GetType()) {
				ipParts = ((IPAddressResourceRecord)answer).IPAddress.ToString().Split('.');
				matched = true;
				//	Change B octet to 200.
				answers.Add(new IPAddressResourceRecord(answer.Name, IPAddress.Parse($"{ipParts[0]}.200.{ipParts[2]}.{ipParts[3]}")));
			}
		}

		if (matched) {
			e.Response.AnswerRecords.Clear();
			foreach(var answer in answers) {
				e.Response.AnswerRecords.Add(answer);
			}			
		}
	}
    Console.WriteLine($"{e.Request} => {e.Response}");
}   //	Server_Responded event

The problem is, I see the altered response, a.200.c.d in the console output, but Windows nslookup application displays the unaltered IP address.

Placing breakpoints around, it appears that everything should be working properly code-wise - but obviously something is not right.

I do have a default domain prefix set up on my laptop, call it home.ms. So when I ask for say, www.google.com

• I see a type A request for www.google.com.home.ms, with a response of an SOA record of my router (since it handles home.ms queries)
• followed by a AAAA request for www.google.com.home.ms, with a response of an SOA record for my router again.
• followed by an A request for www.google.com, with a response of my altered AnswerRecord of 142.200.217.100 (however the UNALTERED address, 142.250.217.100, is what nslookup is showing).
• followed by an AAAA request for www.google.com, with an AnswerRecord with the real IPv6 address.

Can you provide any help with figuring out why the unaltered IPv4 address is being sent to nslookup?

[kapetan]

Hi,

I don't think I can help you much, I don't use Windows myself so I don't know how nslookup works. Maybe it uses a hard-coded list of lookup servers?