{"record":{"id":"3ab1b8bff009b04c","repo":"mRemoteNG/mRemoteNG","slug":"could-not-resolve-address-address","errorCode":null,"errorMessage":"Could not resolve address '{address}'","messagePattern":"Could not resolve address '(.+?)'","errorType":"exception","errorClass":"VaultOpenbaoException","httpStatus":null,"severity":"error","filePath":"ExternalConnectors/VO/VaultOpenbao.cs","lineNumber":55,"sourceCode":"        }\n        private static void TestMountType(VaultClient vaultClient, string mount, int VaultOpenbaoSecretEngine) {\n            switch (vaultClient.V1.System.GetSecretBackendAsync(mount).Result.Data.Type.Type) {\n                case \"kv\" when VaultOpenbaoSecretEngine != 0:\n                    throw new VaultOpenbaoException($\"Backend of type kv does not match expected type {VaultOpenbaoSecretEngine}\");\n                case \"ldap\" when VaultOpenbaoSecretEngine != 1 && VaultOpenbaoSecretEngine != 2:\n                    throw new VaultOpenbaoException($\"Backend of type ldap does not match expected type {VaultOpenbaoSecretEngine}\");\n                case \"ssh\" when VaultOpenbaoSecretEngine != 3:\n                    throw new VaultOpenbaoException($\"Backend of type ssh does not match expected type {VaultOpenbaoSecretEngine}\");\n            }\n        }\n        public static void ReadOtpSSH(string mount, string role, string? username, string address, out string password) {\n            VaultClient vaultClient = GetClient();\n            TestMountType(vaultClient, mount, 3);\n            if (!IPAddress.TryParse(address, out _)) {\n                try {\n                    var addrs = Dns.GetHostAddressesAsync(address).Result;\n                    if (addrs == null || addrs.Length == 0) {\n                        throw new VaultOpenbaoException($\"Could not resolve address '{address}'\");\n                    }\n                    // Prefer IPv4, otherwise take first available\n                    var selected = addrs.FirstOrDefault(a => a.AddressFamily == AddressFamily.InterNetwork) ?? addrs[0];\n                    address = selected.ToString();\n                } catch (Exception ex) {\n                    throw new VaultOpenbaoException($\"Failed to resolve address '{address}'\", ex.Message);\n                }\n            }\n            var otp = vaultClient.V1.Secrets.SSH.GetCredentialsAsync(role, address, username, mount).Result;\n            password = otp.Data.Key;\n\n        }\n        public static void ReadPasswordSSH(int secretEngine, string mount, string role, string username, out string password) {\n            VaultClient vaultClient = GetClient();\n            TestMountType(vaultClient, mount, secretEngine);\n            switch (secretEngine) {\n                case 0:\n                    var kv = vaultClient.V1.Secrets.KeyValue.V2.ReadSecretAsync(role, mountPoint: mount).Result;","sourceCodeStart":37,"sourceCodeEnd":73,"githubUrl":"https://github.com/mRemoteNG/mRemoteNG/blob/9211babf35209d6171c8ff6e73bd856f11df21a5/ExternalConnectors/VO/VaultOpenbao.cs#L37-L73","documentation":"Thrown by ReadOtpSSH when Dns.GetHostAddressesAsync returns null or an empty array for the given address. The address was not a parseable IP (IPAddress.TryParse failed), so DNS was attempted, but no records came back. It means the hostname exists in the request but resolves to nothing.","triggerScenarios":"Calling ReadOtpSSH with an 'address' that is a hostname which DNS cannot resolve (NXDOMAIN), or resolves to zero addresses; transient DNS outage returning empty.","commonSituations":"Typo in the hostname; host not registered in DNS; client on a network without access to the authoritative DNS; stale connection entry referencing a decommissioned host; VPN not connected so internal DNS is unavailable.","solutions":["Verify the hostname resolves from the same machine: 'nslookup <address>' or 'ping <address>'.","Correct the hostname in the connection entry or connect to the VPN providing the internal DNS zone.","If the host genuinely has no DNS entry, use its IP address directly so IPAddress.TryParse short-circuits the DNS path.","Catch VaultOpenbaoException and present the unresolved hostname to the user for correction."],"exampleFix":"// before\nVaultOpenbao.ReadOtpSSH(mount, role, username, hostname, out var pass);\n\n// after\nif (!IPAddress.TryParse(hostname, out _) && Dns.GetHostAddressesAsync(hostname).Result is { Length: 0 })\n    throw new InvalidOperationException($\"Hostname '{hostname}' does not resolve; check DNS/VPN.\");\nVaultOpenbao.ReadOtpSSH(mount, role, username, hostname, out var pass);","handlingStrategy":"validation","validationCode":"// Resolve the hostname before calling ReadOtpSSH; fail fast with a clear message\nif (!IPAddress.TryParse(address, out _))\n{\n    var found = Dns.GetHostAddresses(address);\n    if (found is null || found.Length == 0)\n        throw new InvalidOperationException($\"'{address}' does not resolve; check DNS/VPN.\");\n}","typeGuard":"static bool IsResolvable(string address) => IPAddress.TryParse(address, out _) || Dns.GetHostAddresses(address).Length > 0;","tryCatchPattern":"try { VaultOpenbao.ReadOtpSSH(mount, role, username, address, out var pass); }\ncatch (VaultOpenbaoException ex) when (ex.Message.Contains(\"Could not resolve\"))\n{ /* hostname NXDOMAIN; correct it or connect VPN */ }","preventionTips":["Validate the hostname resolves from the client machine before the call.","Prefer IP addresses when DNS is unreliable to short-circuit resolution.","Ensure the client is on a network with access to the authoritative DNS.","Keep connection entries' hostnames current; prune decommissioned hosts."],"tags":["vault","openbao","dns","resolution","external-connectors"],"backgroundTag":null,"analyzedSha":"9211babf35209d6171c8ff6e73bd856f11df21a5","analyzedAt":"2026-08-13T19:31:27.817Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}