3 ms·

I'm also curious. Especially since curl 7.64.1 (Release-Date: 2019-03-27, on macOS) says: % curl 'http://1.1/' error code: 1003 while curl 7.85.0 (Release

I'm also curious. Especially since curl 7.64.1 (Release-Date: 2019-03-27, on macOS) says: % curl 'http://1.1/' error code: 1003 while curl 7.85.0 (Release-Date: 2022-08-31, on FreeBSD) says: % curl 'http://1.1/' <html> <head><title>301 Moved Permanently</title></head> <body> <center><h1>301 Moved Permanently</h1></center> <hr><center>cloudflare</center> </body> </html>

cyral 4y ago
That is because their http:// http:// site redirects to https:// https://
- eesmith 4y ago
  Sure, but why do the two different versions of curl give different results? With 7.64.1: % curl --dump-header /dev/tty 'http://1.1/' HTTP/1.1 403 Forbidden Date: Sun, 11 Sep 2022 19:01:53 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 16 Connection: close X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Server: cloudflare CF-RAY: 7492a7924b2bd895-CPH error code: 1003 (Note that curl 'https://1.0.0.1/ https://1.0.0.1/' works just fine, so it's not like curl is blocked by the server on general principle.) With 7.85.0: % curl --dump-header /dev/tty 'http://1.1/' HTTP/1.1 301 Moved Permanently Server: cloudflare Date: Sun, 11 Sep 2022 19:03:09 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Location: https://1.0.0.1/ CF-RAY: 7492a96a181df18a-PIT <html> <head><title>301 Moved Permanently</title></head> <body> <center><h1>301 Moved Permanently</h1></center> <hr><center>cloudflare</center> </body> </html>
  - A321321 4y ago
    Curl wasn’t able to normalise ip adresses till this commit [0] [0] https://github.com/curl/curl/commit/56a037cc0ad1b2a770d0c08d3d09dee1ce600f0f https://github.com/curl/curl/commit/56a037cc0ad1b2a770d0c08d...
    - judge2020 4y ago
      Indeed - so while it's hitting Cloudflare, the 1.1.1.1 IPs are all technically vhosts for `cloudflare-dns.com`, so a good `host` header in the request is required to reach it. For this reason, you could use a CNAME setup[0] and instead of using CNAMEs for proxied subdomains, you input 1.1.1.1 A records in your authoritative dns, and everything on Cloudflare's side will still see your hostname in the host header / SNI, and your website will load. 0: https://developers.cloudflare.com/dns/zone-setups/partial-setup/ https://developers.cloudflare.com/dns/zone-setups/partial-se...
A321321 4y ago
Yeah, that was a bug in curl till 7.77. If you want to full details, see [0] [0] https://daniel.haxx.se/blog/2021/04/19/curl-those-funny-ipv4-addresses/ https://daniel.haxx.se/blog/2021/04/19/curl-those-funny-ipv4...
- eesmith 4y ago
  That's the answer I was hoping for. Thanks!
gdavisson 4y ago
Interesting. If you use curl -v, you can see that the difference is that the newer version of curl canonicalizes(?) the Host: header to "1.0.0.1", which the server recognizes and responds to with a redirect. The older version sends "1.1" as the Host: header, which the server doesn't recognize, so you get a "403 Forbidden" response with the cryptic "error code: 1003" in the body. I get the same behavior from other nonstandard ways of specifying 1.0.0.1, like "curl http://01.00.00.01/ http://01.00.00.01/"

cyral 4y ago

That is because their http:// http:// site redirects to https:// https://

eesmith 4y ago
Sure, but why do the two different versions of curl give different results? With 7.64.1: % curl --dump-header /dev/tty 'http://1.1/' HTTP/1.1 403 Forbidden Date: Sun, 11 Sep 2022 19:01:53 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 16 Connection: close X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Server: cloudflare CF-RAY: 7492a7924b2bd895-CPH error code: 1003 (Note that curl 'https://1.0.0.1/ https://1.0.0.1/' works just fine, so it's not like curl is blocked by the server on general principle.) With 7.85.0: % curl --dump-header /dev/tty 'http://1.1/' HTTP/1.1 301 Moved Permanently Server: cloudflare Date: Sun, 11 Sep 2022 19:03:09 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Location: https://1.0.0.1/ CF-RAY: 7492a96a181df18a-PIT <html> <head><title>301 Moved Permanently</title></head> <body> <center><h1>301 Moved Permanently</h1></center> <hr><center>cloudflare</center> </body> </html>
- A321321 4y ago
  Curl wasn’t able to normalise ip adresses till this commit [0] [0] https://github.com/curl/curl/commit/56a037cc0ad1b2a770d0c08d3d09dee1ce600f0f https://github.com/curl/curl/commit/56a037cc0ad1b2a770d0c08d...
  - judge2020 4y ago
    Indeed - so while it's hitting Cloudflare, the 1.1.1.1 IPs are all technically vhosts for `cloudflare-dns.com`, so a good `host` header in the request is required to reach it. For this reason, you could use a CNAME setup[0] and instead of using CNAMEs for proxied subdomains, you input 1.1.1.1 A records in your authoritative dns, and everything on Cloudflare's side will still see your hostname in the host header / SNI, and your website will load. 0: https://developers.cloudflare.com/dns/zone-setups/partial-setup/ https://developers.cloudflare.com/dns/zone-setups/partial-se...

A321321 4y ago

Yeah, that was a bug in curl till 7.77. If you want to full details, see [0] [0] https://daniel.haxx.se/blog/2021/04/19/curl-those-funny-ipv4-addresses/ https://daniel.haxx.se/blog/2021/04/19/curl-those-funny-ipv4...

eesmith 4y ago
That's the answer I was hoping for. Thanks!

gdavisson 4y ago

Interesting. If you use curl -v, you can see that the difference is that the newer version of curl canonicalizes(?) the Host: header to "1.0.0.1", which the server recognizes and responds to with a redirect. The older version sends "1.1" as the Host: header, which the server doesn't recognize, so you get a "403 Forbidden" response with the cryptic "error code: 1003" in the body. I get the same behavior from other nonstandard ways of specifying 1.0.0.1, like "curl http://01.00.00.01/ http://01.00.00.01/"