mRemoteNG/mRemoteNG · error · VaultOpenbaoException

Could not resolve address '{address}'

Error message

Could not resolve address '{address}'

What it means

Thrown by ReadOtpSSH when Dns.GetHostAddressesAsync returns null or an empty array for the given address. The address was not a parseable IP (IPAddress.TryParse failed), so DNS was attempted, but no records came back. It means the hostname exists in the request but resolves to nothing.

Source

Thrown at ExternalConnectors/VO/VaultOpenbao.cs:55

        }
        private static void TestMountType(VaultClient vaultClient, string mount, int VaultOpenbaoSecretEngine) {
            switch (vaultClient.V1.System.GetSecretBackendAsync(mount).Result.Data.Type.Type) {
                case "kv" when VaultOpenbaoSecretEngine != 0:
                    throw new VaultOpenbaoException($"Backend of type kv does not match expected type {VaultOpenbaoSecretEngine}");
                case "ldap" when VaultOpenbaoSecretEngine != 1 && VaultOpenbaoSecretEngine != 2:
                    throw new VaultOpenbaoException($"Backend of type ldap does not match expected type {VaultOpenbaoSecretEngine}");
                case "ssh" when VaultOpenbaoSecretEngine != 3:
                    throw new VaultOpenbaoException($"Backend of type ssh does not match expected type {VaultOpenbaoSecretEngine}");
            }
        }
        public static void ReadOtpSSH(string mount, string role, string? username, string address, out string password) {
            VaultClient vaultClient = GetClient();
            TestMountType(vaultClient, mount, 3);
            if (!IPAddress.TryParse(address, out _)) {
                try {
                    var addrs = Dns.GetHostAddressesAsync(address).Result;
                    if (addrs == null || addrs.Length == 0) {
                        throw new VaultOpenbaoException($"Could not resolve address '{address}'");
                    }
                    // Prefer IPv4, otherwise take first available
                    var selected = addrs.FirstOrDefault(a => a.AddressFamily == AddressFamily.InterNetwork) ?? addrs[0];
                    address = selected.ToString();
                } catch (Exception ex) {
                    throw new VaultOpenbaoException($"Failed to resolve address '{address}'", ex.Message);
                }
            }
            var otp = vaultClient.V1.Secrets.SSH.GetCredentialsAsync(role, address, username, mount).Result;
            password = otp.Data.Key;

        }
        public static void ReadPasswordSSH(int secretEngine, string mount, string role, string username, out string password) {
            VaultClient vaultClient = GetClient();
            TestMountType(vaultClient, mount, secretEngine);
            switch (secretEngine) {
                case 0:
                    var kv = vaultClient.V1.Secrets.KeyValue.V2.ReadSecretAsync(role, mountPoint: mount).Result;

View on GitHub (pinned to 9211babf35)

Solutions

  1. Verify the hostname resolves from the same machine: 'nslookup <address>' or 'ping <address>'.
  2. Correct the hostname in the connection entry or connect to the VPN providing the internal DNS zone.
  3. If the host genuinely has no DNS entry, use its IP address directly so IPAddress.TryParse short-circuits the DNS path.
  4. Catch VaultOpenbaoException and present the unresolved hostname to the user for correction.

Example fix

// before
VaultOpenbao.ReadOtpSSH(mount, role, username, hostname, out var pass);

// after
if (!IPAddress.TryParse(hostname, out _) && Dns.GetHostAddressesAsync(hostname).Result is { Length: 0 })
    throw new InvalidOperationException($"Hostname '{hostname}' does not resolve; check DNS/VPN.");
VaultOpenbao.ReadOtpSSH(mount, role, username, hostname, out var pass);
Defensive patterns

Strategy: validation

Validate before calling

// Resolve the hostname before calling ReadOtpSSH; fail fast with a clear message
if (!IPAddress.TryParse(address, out _))
{
    var found = Dns.GetHostAddresses(address);
    if (found is null || found.Length == 0)
        throw new InvalidOperationException($"'{address}' does not resolve; check DNS/VPN.");
}

Type guard

static bool IsResolvable(string address) => IPAddress.TryParse(address, out _) || Dns.GetHostAddresses(address).Length > 0;

Try / catch

try { VaultOpenbao.ReadOtpSSH(mount, role, username, address, out var pass); }
catch (VaultOpenbaoException ex) when (ex.Message.Contains("Could not resolve"))
{ /* hostname NXDOMAIN; correct it or connect VPN */ }

Prevention

When it happens

Trigger: Calling ReadOtpSSH with an 'address' that is a hostname which DNS cannot resolve (NXDOMAIN), or resolves to zero addresses; transient DNS outage returning empty.

Common situations: Typo in the hostname; host not registered in DNS; client on a network without access to the authoritative DNS; stale connection entry referencing a decommissioned host; VPN not connected so internal DNS is unavailable.

Related errors

AI-assisted analysis of mRemoteNG/mRemoteNG@9211babf35 (2026-08-13). Data as JSON: /api/errors/3ab1b8bff009b04c. Report an issue: GitHub.