DNS lookup base on /etc/hosts file on host computer

[jiramares]

We are running server with maven proxy, that I would like to use. But its name is not resolved inside container:

Caught java.net.UnknownHostException (server_name) 

The reason may be that we resolve the name using local /etc/hosts file instead of DNS? How to make it run correctly?

[jiramares]

I realized that I can put extra_hosts into wg-client service definition (that is in .devcontainer/sandcat/compose-proxy.yml) but do I want to edit this file (or I can mount another version, or modify existing version of /etc/hosts in container). Don't know what is easier and how to make it easy-to-use.

[adamw]

I think there are two solutions:

1. edit .devcontainer/sandcat/compose-proxy.yml - you might do that, although if you do run sandcat init again the future, the change will be overwritten. But the generated files in general can be customised. So this is the "quick fix" route
2. a more general (and persistent) solution would be to add a new setting to settings.json, sth like extra_hosts, which would then be propagated to /etc/hosts on startup - wdyt?

[jiramares]

#1 I am using at the moment and it works.
#2 Is the right way and looks nice

At the moment I am fighting with the self-signed certifikate for this no-DNS-entry-server because it has to be added into wg-client, so please, try to add configuration for it too. Thanks

[adamw]

Can you describe that second issue in more detail? I don't think I understand it

[jiramares]

With #1 I meant your 1. point and with #2 your 2.

The problem that I have at the moment is that our server uses self-signed-certificate for HTTPS and I can't make it run. The only way that I made it working is using --set ssl_insecure=true with mitmproxy, but that is not IDEAL solution.

I have tried --set ssl_verify_upstream_trusted_ca=/ca/svt-ca.crt that made working curl but sbt can't resolve the artefacts because of:

[error] [launcher] xsbt.boot.internal.shaded.coursier.error.ResolutionError$CantDownloadModule: Error downloading org.scala-sbt:sbt:1.12.5
  not found: /home/vscode/.ivy2/local/org.scala-sbt/sbt/1.12.5/ivys/ivy.xml
  download error: Caught javax.net.ssl.SSLHandshakeException ((certificate_unknown) No name matching our_server_name found) while downloading https://ids/nexus/repository/maven-public/org/scala-sbt/sbt/1.12.5/sbt-1.12.5.pom

Now I tried to add our_server_CA.crt into the system of the mitmproxy image but it still reports same error.

[jiramares]

To sum up changes I have to do make done to be able to connect to server, that is not resolved via DNS but via /etc/hosts and for HTTPS uses self-signed certificate (using such serve as artifact resolver proxy).

First in devcontainer.json I have to specify (because JetBrains IDEA overrides command specified in docker image - this keep starting app-init.sh script).:

"overrideCommand": false,

I have to change Dockerfile.app to create .sbt in home directory (RUN mkdir -p /home/vscode/.sbt) to mount the file with repositories definition:

[repositories]
  local
  my-maven-proxy: https://our_server/nexus/repository/maven-public

into the container add (change in compose-all.yml):

volumes:
  - ./repositories:/home/vscode/.sbt/repositories:ro

This was the easier part. Now comes the network specifiic details. I have to tell wg-client service that there exists out_server with IP address aaa.bbb.ccc.ddd, so into sandcat/compose-proxy.yml add:

extra_hosts:
  - "our_server:aaa.bbb.ccc.ddd"

And mitmproxy has to know certificate of out CA, so I have to change the image used for it by changing the definition of mitmproxy service (from using the image mitmproxy/mitmproxy:latest to building a new one):

build:
  context: .
  dockerfile: Dockerfile.mitmproxy

And the docker file Dockerfile.mitmproxy:

FROM mitmproxy/mitmproxy:latest
COPY our-ca.crt /usr/local/share/ca-certificates/our-ca.crt
RUN update-ca-certificates

It adds our-ca.crt into /etc/ssl/certs/ca-certificates.crt. It enables changing the start-up parameters to mitmproxy in compose file:

command: mitmweb --mode wireguard --web-host 0.0.0.0 --set ssl_verify_upstream_trusted_ca=/etc/ssl/certs/ca-certificates.crt --set web_password=mitmproxy -s /scripts/mitmproxy_addon.py

I have specify /etc/ssl/certs/ca-certificates.crt as upstrem trusted CA because of the new image it contains our CA certificate (--set ssl_verify_upstream_trusted_ca=/etc/ssl/certs/ca-certificates.crt).

And finally from some reason the connection to our server is done via IP address instead of name, so sbt doesn't accept the provided certificate chain. Therefore I have to change the sandcat/scripts/mitmproxy_addon.py to contain tls_clienthallo handler:

    def tls_clienthello(self, data: tls.ClientHelloData):
        # When client connects to out IP we force him SNI 'our_server'
        # It makes mitmproxy to generate certificate for 'our_server'
        server_addr = data.context.server.address
        if server_addr and server_addr[0] == "aaa.bbb.ccc.ddd":
            data.context.client.sni = "our_server"

Now I can finally build using sbt. I don't know whether this is the only correct way but I tried to make as much simple as it could be.

So I expect adding extra_hosts definition into settings.json we can provide changes automatically into the wg_client docker compose file and into the mitmproxy addon script.

To handle the self-signed certificates is more complicated because I haven't found easier way than adding the certificate system wide into mitmproxy image and specifying the new ca-certificates via command line parameter.

And I am not sure why in mitmproxy event log appears:

[08:53:36.891][10.0.0.1:53952] TLS Error: (-1, 'Unexpected EOF')

I am not so advanced network guru to aunderstand why it happen and whether it is a problem (but it looks like working)