-
Notifications
You must be signed in to change notification settings - Fork 2.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[ncat] Ability to control hostname resolution for proxy destinations #1439
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
From a read-through of the code, this looks like it'll solve the issue. I'm traveling the next two weeks, so I'm not sure when I'll get a chance to actually give it a shot, but I'll try to find time this this week if I can.
@@ -647,6 +659,7 @@ int main(int argc, char *argv[]) | |||
" --proxy <addr[:port]> Specify address of host to proxy through\n" | |||
" --proxy-type <type> Specify proxy type (\"http\", \"socks4\", \"socks5\")\n" | |||
" --proxy-auth <auth> Authenticate with HTTP or SOCKS proxy server\n" | |||
" --proxy-dns <type> Specify where to resolve proxy destination\n" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
probably should list the possible types here (none, local, remote, both)... and maybe what they mean...
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Not enough space if we want to keep it on a single line
I checked out your branch and tried to build, but the build fails on:
|
Nevermind I think this is #1379 I'll give the solution there a shot. |
local/remote/both all work as expected, thanks! I will note that
|
Yup; my bad. Hopefully fixed. |
Committed as r37586. |
In connect mode, currently all proxy destinations are directly passed onto the remote proxy server, without trying to resolve them locally. This behavior has raised some concerns.
This proposal implements a new ncat option that provides control over whether these hostnames are resolved by the remote proxy server or locally, by Ncat itself.
Usage:
local
- Hostnames are resolved locally on the Ncat host. Ncat exits with error if the hostname cannot be resolved.remote
- Hostnames are passed directly onto the remote proxy server. This is the default behavior.both
- Hostname resolution is first attempted on the Ncat host. Unresolvable hostnames are passed onto the remote proxy server.none
- Hostname resolution is completely disabled. Only an IPv4 or IPv6 address can be used as the proxy destination.Note that this new option is complementing, not replacing, option
--no-dns
, which controls all existing hostname resolution, such as non-proxied targets, hops, source address, and the proxy server itself.