12 ms·
Curl those funny IPv4 addresses
- IshKebab 6y agoWouldn't it make more sense to just not support those weird formats? Nobody uses them and they can help attackers (mentioned in the post).
- pferde 6y agoHow do you know nobody uses them? I'd be willing to bet that there are many older in-house scripts puttering away in some dark, webbed corners of internal networks, which rely on this functionality, e.g. because they are getting their input from some obscure network appliances which print IP addresses like that. I would fully expect support for these "weird" formats to be a (enabled by default) build-time option, but it's a good thing that curl maintainer is not just cutting it off right away.
- throwaway823882 6y agoPeople trying to circumvent censorship often look like "attackers". When I was in middle school, I needed to research a paper in the school library computers. Their stupid computers were always messed up; first the proxy settings weren't configured in half the machines (I fixed that, and got scolded), then the anti-virus wasn't working (fixed that, got scolded). Then the proxies wouldn't let me search for my paper. I was a budding hacker, so I figured out the numbering trick mentioned in this article, and was able to bypass the proxy and do my research for my paper. This was a long time ago but I bet the same situation is just as relevant today. (Doubtful that you'd use curl in this scenario, but nice to know they are preserving useful functionality rather than throwing it out)
- cmeacham98 6y agoQuestion: how did this trick help you bypass the proxy? The only way I can think of this possibly helping you is by changing the Host header and that somehow fooling the proxy into allowing your connection through. However some random testing with both a modern browser and a really old version of firefox I have installed shows that it seems to convert the 'weird number format' into a proper IP address, even when using a proxy. In other words, I cannot see how using these weird IPs ever could make a difference from the proxy's perspective.
- kalleboo 6y agoI've seen software that uses the "single decimal number" representation in order to store IP address in a database integer type column
- IshKebab 6y agoThat's how they're stored in memory too, but that's just for storage. It is probably decoded to normal dotted form by the database layer.
- rwmj 6y agoSlightly surprised that curl went this way, instead of actively rejecting them. Is there anyone using these obscure formats in the real world, except for attackers?
- zegl 6y agoI had the same reaction, especially after Daniels paragraph on how the more obscure formats can and has been used by bypass validation filters. But, I'm also happy for having curl be more consistent with itself, so that it has the same behaviour on developer workstation and in production, since I'd imagine most pen-testing happens by developers locally.
- zwp 6y agoI agree. The article even says that these odd formats are used to bypass filters but cannot pinpoint why BSD 4.2 added support for them in 1983. It hints that certificate validation fails in some cases, but that seems even more niche. What applications are using certs with IP-in-CN anyway in 2021? Shouldn't any IPs be in the "typed" SAN extension? Commit is here: https://github.com/curl/curl/commit/56a037cc0ad1b2a770d0c08d3d09dee1ce600f0f https://github.com/curl/curl/commit/56a037cc0ad1b2a770d0c08d...
- anshorei 6y agoStoring ipv4 addresses as 32bit numbers is common so I can certainly see a use for that.
- chrisshroba 6y agoI'm not sure why you were downvoted. If this is true, it seems like it would save developers a conversion step when making a request.
- pierrebai 6y agoI would guess because the point of the number parsing is to end-up producing that final 32-bits value. If you already have the 32-bits value, there is no point in parsing it, so there is no point in supporting it in the address text parser. Like the article mention, supporting obscure features just makes it more likely that they can be exploited for nefarious purposes. It's not worth saving typing 4-5 characters from times to times. Before reading the article, I would have assumed for example that 127.1 would be 127.1.0.0, not 127.0.0.1.
- loloquwowndueo 6y agoCurl is so awesome :)
- gspr 6y agoThis is so wholesome: https://twitter.com/bagder/status/1384147826133790724?s=20 https://twitter.com/bagder/status/1384147826133790724?s=20
- fnordist 6y agoI like to use these "funny" addresses for two purposes: ping 1.1 (1.0.0.1 - cloudflare dns server) use 10.1 10.2 10.3 as IP addresses in my home network (10.0.0.1/24) off-topic: thanks @Daniel Stenberg for curl and for rockbox back in the day when it first showed me the wonders of open-source.
- eloeffler 6y agoDidn't know they came from the same person. Thanks for bringing Rockbox back to mind! That was the first custom firmware I've been toying around with, trying to watch scaled down Star Wars - Clone Wars on the tiny 1,5inch screen of my iPod 2G :D Also I see rockbox is still active. Nice
- t0mas88 6y agoNice! Rockbox was the first open source project I was involved in. In the iRiver H120 days. Really cool to see it still alive.
- lazyweb 6y agoI wonder how much more effective malicious scripts might be if something like "curl -L 16843009" is used as an obfuscation. Sure, it would have to check the locally installed curl version first. But hiding something like this away in a deeply nested function .. anyway, don't do "curl | sudo bash", kids.
- inshadows 6y ago> don't do "curl | sudo bash", kids. But do "npm"? Is "npm" any safer? > inb4 sudo
- 1vuio0pswjnm7 6y agoOriginal netcat supports abbreviated addresses such 127.1 instead of 127.0.0.1 Have not seen many other programs adopt this. It's useful. Less to type.
- 0x0 6y agoIt should be supported by most programs that use the c library to resolve hostnames, I believe.
- tremon 6y agoIt's also ambiguous. Why is 127.1 equal to 127.0.0.1 but not 127.1.0.0? Why would 127.1.1 be equal to 127.1.0.1 but not 127.0.1.1 or 127.1.1.0? Neither of those addresses can be discarded because they're base addresses, since the subnet 127/8 only has one base address: 127.0.0.0 At least IPv6 made this practice non-ambiguous by requiring a double colon (::) and mandating that at most one :: can exist in a valid address.
- scbrg 6y agoIt's not really ambiguous. 127.X does not equal 127.0.0.X. 127.X means, the first octet is described by the first number, and the last three octets is described by the second number, and X is not limited to 0-255. Thus 127.256 is equivalent to 127.0.1.0, something that would not be possible to express with your alternative interpretations. It doesn't just mean "fill in zeros".
- kalleboo 6y agoI just tried it in Safari and it worked, so that's nice at least. Thanks for the tip!
- mixmastamyk 6y agoWow, almost thirty years on the internet and learned a new thing today. I often wanted hexadecimal IP4 addresses because the standard format is hard to type and some octets in decimal expand to three digits. However seeing it in action and requiring the "0x…" prefix has made me less enthused: ping 0x0a000101 ping 0x0a.0x00.0x01.0x01 Frankly that sucks, no wonder it never caught on. Something shorter with a fixed length like the below would have made me happier, though the ship sailed decades ago: ping 0a00.0101