funman300/OpenFUT
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tools/windows: scoped DNS resolver for the FIFA 17 roster hostname

Browse Source 
FIFA 17's ProtoSSL verifies the roster certificate by dNSName only, so the
client must reach the roster as winter15.gosredirector.ea.com. Retested on
Windows 2026-08-23: an IP-addressed roster host is refused even though the
certificate carries IP Address:10.10.0.120 as a SAN.

Public DNS points that name at EA's dead 159.153.51.20, so the client has to
resolve it to us. scoped-dns.py pins exactly that one name and forwards every
other query upstream verbatim, so a client pointed at it cannot lose general
resolution -- verified against www.microsoft.com, github.com and
www.msftconnecttest.com.

Paired with a Windows NRPT rule rather than a hosts entry: per-name, auditable
via Get-DnsClientNrptRule, and revertible in one command. A hosts edit on this
machine had previously taken its whole internet down.
This commit is contained in:
funman300
2026-08-23 01:34:13 +00:00
parent 8c353c6c66
commit 286a44461d
2 changed files with 180 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/windows/README.md
+35
View File
@@ -85,6 +85,41 @@ Copy-Item 'C:\FIFA 17\version.dll.stale-849k.bak' 'C:\FIFA 17\version.dll' -Forc
Always keep a `*.bak` of the live hook before redeploying (the preflight checks
that a rollback backup exists and differs from the live DLL).
## Roster / "FUT Squad Update" — the client MUST reach the roster by HOSTNAME
If FUT fails with **"An error occurred downloading the FUT Squad Update"**, the
client could not fetch `https://<roster>/fifa17/fut/rosterupdate.xml`.
FIFA 17's ProtoSSL verifies that certificate by **dNSName only**. Pointing the
roster at an IP does **not** work even though our certificate carries
`IP Address:10.10.0.120` in its SANs — this was retested on Windows on
2026-08-23 and rejected. Do not retry an IP roster host, and do not reissue the
certificate for an IP SAN. The roster must be reached as
`winter15.gosredirector.ea.com`, which our certificate does carry as a dNSName.
Public DNS resolves that name to EA's dead `159.153.51.20`, so the client has to
be told to resolve it to us. **Use an NRPT rule, not the hosts file.** A hosts
edit on this machine previously took its entire internet down; NRPT is per-name,
auditable with `Get-DnsClientNrptRule`, and reverts in one command.
On the server, run the scoped resolver (needs root for UDP 53):
```bash
sudo python3 tools/windows/scoped-dns.py
```
It answers **only** `winter15.gosredirector.ea.com` and forwards every other
query upstream verbatim, so it cannot strand a client that is pointed at it.
Then start Blaze with `OPENFUT_ROSTER_HOST=winter15.gosredirector.ea.com:8081`.
On the client, as Administrator:
```powershell
Add-DnsClientNrptRule -Namespace "winter15.gosredirector.ea.com" -NameServers "10.10.0.120"
# revert:
Get-DnsClientNrptRule | Where-Object Namespace -eq "winter15.gosredirector.ea.com" | Remove-DnsClientNrptRule -Force
```
## Preflight
`openfut-client-preflight.ps1` is **read-only**: it never launches the game,