Hacker News Reader

Comment by eesmith | Hacker News Reader

I'm also curious. Especially since curl 7.64.1 (Release-Date: 2019-03-27, on macOS) says:

  % curl 'http://1.1/'
  error code: 1003

while curl 7.85.0 (Release-Date: 2022-08-31, on FreeBSD) says:

  % curl 'http://1.1/'
  <html>
  <head><title>301 Moved Permanently</title></head>
  <body>
  <center><h1>301 Moved Permanently</h1></center>
  <hr><center>cloudflare</center>
  </body>
  </html>

View on HN

Yeah, that was a bug in curl till 7.77.

If you want to full details, see [0]

[0] https://daniel.haxx.se/blog/2021/04/19/curl-those-funny-ipv4...

That's the answer I was hoping for. Thanks!

Interesting. If you use curl -v, you can see that the difference is that the newer version of curl canonicalizes(?) the Host: header to "1.0.0.1", which the server recognizes and responds to with a redirect. The older version sends "1.1" as the Host: header, which the server doesn't recognize, so you get a "403 Forbidden" response with the cryptic "error code: 1003" in the body.

I get the same behavior from other nonstandard ways of specifying 1.0.0.1, like "curl http://01.00.00.01/"

That is because their http:// site redirects to https://

Sure, but why do the two different versions of curl give different results? With 7.64.1:

  % curl --dump-header /dev/tty 'http://1.1/'
  HTTP/1.1 403 Forbidden
  Date: Sun, 11 Sep 2022 19:01:53 GMT
  Content-Type: text/plain; charset=UTF-8
  Content-Length: 16
  Connection: close
  X-Frame-Options: SAMEORIGIN
  Referrer-Policy: same-origin
  Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
  Expires: Thu, 01 Jan 1970 00:00:01 GMT
  Server: cloudflare
  CF-RAY: 7492a7924b2bd895-CPH

  error code: 1003

(Note that curl 'https://1.0.0.1/' works just fine, so it's not like curl is blocked by the server on general principle.)

With 7.85.0:

  % curl --dump-header /dev/tty 'http://1.1/'
  HTTP/1.1 301 Moved Permanently
  Server: cloudflare
  Date: Sun, 11 Sep 2022 19:03:09 GMT
  Content-Type: text/html
  Content-Length: 167
  Connection: keep-alive
  Location: https://1.0.0.1/
  CF-RAY: 7492a96a181df18a-PIT

  <html>
  <head><title>301 Moved Permanently</title></head>
  <body>
  <center><h1>301 Moved Permanently</h1></center>
  <hr><center>cloudflare</center>
  </body>
  </html>

Curl wasn’t able to normalise ip adresses till this commit [0]

[0] https://github.com/curl/curl/commit/56a037cc0ad1b2a770d0c08d...

Indeed - so while it's hitting Cloudflare, the 1.1.1.1 IPs are all technically vhosts for `cloudflare-dns.com`, so a good `host` header in the request is required to reach it.

For this reason, you could use a CNAME setup[0] and instead of using CNAMEs for proxied subdomains, you input 1.1.1.1 A records in your authoritative dns, and everything on Cloudflare's side will still see your hostname in the host header / SNI, and your website will load.

0: https://developers.cloudflare.com/dns/zone-setups/partial-se...

Reply on news.ycombinator.com