Improve treatment of bogons in analysis (not all bogons are made equal) #107
Description
In doing some work on the new analysis pipeline I came across an interesting case which we should probably think about how to handle properly.
The case is this one: https://explorer.ooni.org/m/20241203074026.659796_IT_webconnectivity_714c5108998baea8.
Currently the analysis logic scores measurements where the DNS answer was a bogon and there was no successful TLS as a strong signal for blocking. However this case highlights how we should not be treating all bogons equally.
This particular IPv6 bogon (64:ff9b:1:fffe::68f4:2a01), is in the prefix that's allocated as per RFC 6052 (https://datatracker.ietf.org/doc/html/rfc6052) for use in IPv6 to IPv4 mappings.
Basically inside of this bogon address the last 32 bits are used to encode the target IP address such that if there is an IPv6 translator on the network it's able to route traffic towards the target IPs.
In this example the last 32 bits are 68f4:2a01 which using this one-liner:
python -c 'x="68f4:2a01".split(":");print(f"{int(x[0], 16) >> 8}.{int(x[0], 16) & 0xFF}.{int(x[1], 16) >> 8}.{int(x[1], 16) & 0xFF}")'
map to:
104.244.42.1
That checks out with what we see in the measurement.
I don't understand so well how and in which circumstances this would be happening.
That is is it the operator of the site (which doesn't natively support V6) that configures their DNS zone to return these addresses such that IPv6 only networks that have a v6-to-v4 translator service deployed are able to route traffic to their v4 address?
I did a quick search in measurements from the last month to see how prevalent this is and found it appears in DNS resolutions for 565 unique domains and for those which are very tested, this appears on 15+ distinct resolvers, so I am excluding this is a behavior of the resolver.
Moreover in the case of twitter, we observe that there are instances in which we get an answer that contains a V6 address that isn't in this special prefix, which makes we wonder why this is happening.