It's interesting that most of the comments here are about using this feature to bypass security restrictions (whether valid or not). It says a lot about the attack surface of GNU utilities caused by featuritis.
TIL: You can make HTTP requests without curl using Bash /dev/TCP
41–50 of 255 posts
Re: TIL: You can make HTTP requests without curl using Bash /dev/TCP
#42Earlier quoted context omitted.
I always recommend to not have any dependencies outside of the code. So we start at compiling the codebase (Rust) against MUSL. That way we can run it with FROM scratch images. If we need more tooling available at runtime, then we look at alpine, but still using MUSL. If MUSL itself is proving problematic, or if some of the libraries we use need glibc then we can look at using some locked down image. The cool part ab…
> The cool part about FROM scratch images is that you'll never have to update your base image to address CVEs. Only your software and its (compiled) dependencies. What's the benefit really, though? If you still need to be able to rapidly deploy a new image in response to a dependency CVE, what have you gained?
You've gained that happening much less frequently. The tradeoff is making every other problem harder to diagnose.
Re: TIL: You can make HTTP requests without curl using Bash /dev/TCP
#43> As it turns out, bash can speak HTTP by itself. No, it can not. Bash lets you open TCP sockets. What you are doing here is trying to speak HTTP yourself, which is fine for testing and debugging, and hella cool for fun to do by hand, but you will shoot yourself in the foot if you try to use this pseudo http client unattended in reality. This toy code does not parse HTTP properly and will break. You could of course w…
> No, it can not. Bash lets you open TCP sockets. Very fair pushback -- I did get carried away and will update the article to be more precise. Thanks for raising it! > For less insane, non-bash shells there is always nc which is usually probably the wiser choice. For completeness, `nc` or any netcat equvialent I could think of was not available in the image I was trying this with. It would certainly be a better optio…
[flagged]
Re: TIL: You can make HTTP requests without curl using Bash /dev/TCP
#44Re: TIL: You can make HTTP requests without curl using Bash /dev/TCP
#45Earlier quoted context omitted.
it's not that insane. i've been manually typing http requests in since before http/1.1 and the mandatory host header. it is insane to use it for anything serious (also the opposite, implementing webservers in bash), but for quick testing it's pretty great!
Why wouldn’t you use curl for the quick test?
Sometimes you want to do something that curl cannot express, e.g. timing, protocol oddities, etc. For example you may want to issue a CONNECT to an echo server through a proxy and observe the bytes flowing back and forth. You may want to see what happens when conflicting hop-by-hop headers are specified without worrying about the client's (curl's) interpretation of them. A simple nc -c (or openssl s_client -crlf) lets you do all of that.
Re: TIL: You can make HTTP requests without curl using Bash /dev/TCP
#46Re: TIL: You can make HTTP requests without curl using Bash /dev/TCP
#47> As it turns out, bash can speak HTTP by itself. No, it can not. Bash lets you open TCP sockets. What you are doing here is trying to speak HTTP yourself, which is fine for testing and debugging, and hella cool for fun to do by hand, but you will shoot yourself in the foot if you try to use this pseudo http client unattended in reality. This toy code does not parse HTTP properly and will break. You could of course w…
>No, you can't write 10 lines of code, you have to import a 100k LOC dependency
Common misconception, if you want to replace a dependency on a swiss knife you don't need to implement a swiss knife, sometimes you can just implement the last helix of the corkscrew.
Re: TIL: You can make HTTP requests without curl using Bash /dev/TCP
#48Earlier quoted context omitted.
It seems pretty cool, but I am wondering if there's any drawback on just using images that support curl? I can't think of any and to me it's kinda a must have, even on production images
That is indeed a solid pushback! :) For what its worth, this container used `python:3.12.2-slim-bookworm` and I really would not expect that sort of an image to bundle `curl` -- even if it is intended for production.
You can also use the sockets lib in that case, you depend on POSIX instead of Linux
Re: TIL: You can make HTTP requests without curl using Bash /dev/TCP
#49Earlier quoted context omitted.
It seems pretty cool, but I am wondering if there's any drawback on just using images that support curl? I can't think of any and to me it's kinda a must have, even on production images
This of course only supports http, not https. It's great for health checks e.g. in a docker environment. To do https, you'd have to use something like socat, but of course that doesn't use bash only.
Https is almost always terminated separately from the application code.
Re: TIL: You can make HTTP requests without curl using Bash /dev/TCP
#50Earlier quoted context omitted.
it's not that insane. i've been manually typing http requests in since before http/1.1 and the mandatory host header. it is insane to use it for anything serious (also the opposite, implementing webservers in bash), but for quick testing it's pretty great!
Why wouldn’t you use curl for the quick test?
because in those days there was no curl, or wget. and then when there was, there was no guarantee they'd be installed.
telnet was always there though. it also worked for speaking all the other plaintext internet protocols. (imap, pop, smtp, etc)