0

When attempting to use curl to get around a misconfigured DNS entry (experimenting and not known at the time), --resolve seemed like the right way to go. However, the argument didn't behave the way I expected and (successfully) 404's.

Editing the system's /etc/hosts file to add the proper entry works fine, so it seems like it must be part of how curl resolves DNS. And indeed, changing the IP in /etc/hosts to something invalid also receives priority over the --resolve arg and 404s.

Is it possible to force curl to resolve a specific IP for a name over whatever the system provides via a builtin argument? (and is it --resolve combined with something else?)

Example below; the names and addresses have been changed to protect the guilty.

% curl -L -vv --resolve "foo.example.com:80:10.14.0.1" "https://foo.example.com/path"
* Added foo.example.com:80:10.14.0.1 to DNS cache
*   Trying 10.15.0.1
* TCP_NODELAY set
* Connected to foo.example.com (10.15.0.1) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/cert.pem
 CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS alert, unknown CA (560):
* SSL certificate problem: unable to get local issuer certificate
* Closing connection 0
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
ti7
  • 215
  • 2
  • 9

1 Answers1

0

I just discovered the answer; --resolve needs to specify the right port (which may be several ports)

Additionally, * may be used for the host (but not the port!), which simplifies the argument. The manpage is quite clear about it all.

% curl -L -vv --resolve "*:80:10.14.0.1" --resolve "*:443:10.14.0.1" "https://foo.example.com/path"
* Added foo.example.com:443:10.14.0.1 to DNS cache
*   Trying 10.14.0.1
ti7
  • 215
  • 2
  • 9