Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

NoProxy wildcard doesn't apply to IP addresses and is handled as a wildcard even in the presence of other elements in the comma-separated list #2579

Open
otaconix opened this issue Mar 5, 2025 · 0 comments

Comments

@otaconix
Copy link

otaconix commented Mar 5, 2025

According to #1332, the intent of reqwest's NoProxy was to mirror curl's behavior as much as possible. However, its handling of the * wildcard differs from curl in that:

  • it does not apply to IP addresses (i.e. a request to http://127.0.0.1:8080 will be proxied despite the * noproxy)
  • it is interpreted as the wildcard even if there are other elements in the noproxy list (i.e. reqwest will not proxy a request to http://example.test if noproxy is otherhost.example,*, whereas curl would use the configured proxy)

curl examples (where http://127.0.0.1:8081/test serves proxy, and http://127.0.0.1:8082/test services noproxy):

command output comment
curl --proxy http://localhost:8081 --noproxy '*' http://127.0.0.1:8082/test noproxy Note that * applies to the IP address
curl --proxy http://localhost:8081 --noproxy 'example.test,*' http://127.0.0.1:8082/test proxy The * does not apply here

Additionally some quotes from curl's manpage:

--noproxy

Comma-separated list of hosts for which not to use a proxy, if one is specified. The only wildcard is a single "*" character, which matches
all hosts, and effectively disables the proxy. Each name in this list is matched as either a domain which contains the hostname, or the
hostname itself. For example, "local.com" would match "local.com", "local.com:80", and "www.local.com", but not "www.notlocal.com".

This option overrides the environment variables that disable the proxy ("no_proxy" and "NO_PROXY") (added in 7.53.0). If there is an
environment variable disabling a proxy, you can set the no proxy list to "" to override it.

IP addresses specified to this option can be provided using CIDR notation (added in 7.86.0): an appended slash and number specifies the
number of network bits out of the address to use in the comparison. For example "192.168.0.0/16" would match all addresses starting with
"192.168".

If --noproxy is provided several times, the last set value is used.

Example:
curl --noproxy "www.example" https://example.com

See also -x, --proxy.

NO_PROXY <comma-separated list of hosts/domains>

list of host names that should not go through any proxy. If set to an asterisk '*' only, it matches all hosts. Each name in this list is
matched as either a domain name which contains the hostname, or the hostname itself.

This environment variable disables use of the proxy even when specified with the -x, --proxy option. That is

NO_PROXY=direct.example.com curl -x http://proxy.example.com
http://direct.example.com

accesses the target URL directly, and

NO_PROXY=direct.example.com curl -x http://proxy.example.com
http://somewhere.example.com

accesses the target URL through the proxy.

The list of host names can also be include numerical IP addresses, and IPv6 versions should then be given without enclosing brackets.

IP addresses can be specified using CIDR notation: an appended slash and number specifies the number of "network bits" out of the address to
use in the comparison (added in 7.86.0). For example "192.168.0.0/16" would match all addresses starting with "192.168".

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant