-
Notifications
You must be signed in to change notification settings - Fork 18k
x/crypto/ssh: Client.ListenTCP should not resolve the bind address locally #67295
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Comments
By coincidence I've also encountered this same surprise today! 😀 How I understand this problem: When using an SSH tunnel to forward a local TCP port to a remote TCP port, the remote TCP port might be addressed using a hostname that the server can resolve but the client cannot. This arises, for example, when the tunnel is being used as a bridge into a private network that isn't otherwise connected to the internet, and that remote network has its own internal DNS. Resolving this client-side means that the address in the remote network must either be specified directly as an IP address or the private IP address must be exposed as a publicly-resolvable hostname (which is atypical in my experience, to avoid disclosing unnecessary information about the remote network). I think this proposal suggests that when the That makes sense to me in principle, but directly sending the address string to the server (without attempting to parse it locally first) would mean that (In particular, I notice that the specification text in the screenshot says "Some strings used for 'address to bind' have special-case semantics", and I would guess those special cases are not echoed in |
IMHO, for local port forwarding, resolving the listen address on the local side is correct, but for remote port forwarding, resolving on the local side of the address that will be listened on the remote side is strange.
Please look RFC. It's about aliases like 0.0.0.0, localhost, 127.0.0.1, [::1], etc |
Duplicate of #37239 |
That is, it is impossible to create a client on golang that would work like OpenSSH! |
Proposal Details
For remote port forward RFC


offers send ip or domain name. Usage net.ResolveTCPAddr on local side deprives golang developers of sending domain name. I suggest sending addr to remote side as is, not as ip
to allow sshd do net.ResolveTCPAddr. The IP address for the same domain on the local side or on the remote side can be very different!
The text was updated successfully, but these errors were encountered: